#!/usr/bin/nft -f
# WARNING: This file is automatically managed by ansible, any changes in it will be discarded on configuration reload

flush ruleset

table inet filter {
  chain input {
    type filter hook input priority 0;

    # allow established/related connections
    ct state { established, related } accept

    # early drop of invalid connections
    ct state invalid drop

    # allow from loopback
    iifname lo accept

    # allow libvirt bridge
    iifname virbr0 accept

    # allow icmp
    ip protocol icmp accept
    ip6 nexthdr icmpv6 accept

    # DHCPv6
    udp sport 547 accept

    # allow ssh, http(s)
    tcp dport { ssh, http, https } accept

    {% if nftables.snmp %}
    # snmp
    udp dport { 161 } accept
    {% endif %}

    {% if nftables.nfs %}
    # NFS
    tcp dport { 111, 2049, 20048, 32765, 32766, 32803, 32769 } accept
    udp dport { 111, 2049, 20048, 32765, 32766, 32803, 32769 } accept
    {% endif %}

    {% if nftables.pds_local %}
    # local network
    ip saddr 147.251.51.160-147.251.51.255 accept
    ip saddr 147.251.48.89 accept # midas (Nikola)
    ip6 saddr 2001:718:801:233::a0-2001:718:801:233::ff accept

    # Local services (ident: 113, postgres: 5432)
    ip saddr 147.251.51.160-147.251.51.255 tcp dport { 113, 5432 } accept
    ip6 saddr 2001:718:801:233::a0-2001:718:801:233::ff tcp dport { 113, 5432 } accept
    {% endif %}

    {{ nft_extra | default("") }}
    {{ nftables.extra | default("") }}

    # everything else
    ip saddr 147.251.51.1-147.251.51.159 reject # junk from other labs
    reject
  }
  chain forward {
    type filter hook forward priority 0;
    drop
  }
  chain output {
    type filter hook output priority 0;
  }

}

# vim:set ts=2 sw=2 et:
