#!/usr/sbin/nft -f

flush ruleset;

define wan_ifname = enp11s0

define lan_ifname = br0

define lo_ifname = lo

define server0_ipv4_addr = 10.1.1.101

define server0_open_tcp_ports = {
        80,  # HTTP
        443, # HTTPS
        25,  # SMTP
        587, # SMTP Submission
        143, # IMAP
        993, # IMAP Over TLS
        7777 # Terraria
};

define server0_open_udp_ports = {
        7777 # Terraria
};

table ip nat {

        chain prerouting {
                type nat hook prerouting priority 0; policy accept;
                iif $wan_ifname tcp dport $server0_open_tcp_ports dnat to $server0_ipv4_addr
                iif $wan_ifname udp dport $server0_open_udp_ports dnat to $server0_ipv4_addr

        }

        chain postrouting {
                type nat hook postrouting priority 100; policy accept;
                oif $wan_ifname masquerade
        }
}

table inet filter {

        chain common_input_filter {
                tcp flags & (fin | syn | rst | psh | ack | urg | cwr) == fin | syn | rst | psh | ack | urg | cwr drop
                tcp flags & (fin | syn | rst | psh | ack | urg | cwr) == 0x0 drop
                ct state { established, related } accept
                ip protocol icmp accept
                icmpv6 type { nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } accept
                tcp dport 22 accept
        }

        chain input {
                type filter hook input priority 0; policy drop;
                iif $lo_ifname accept
                iif $lan_ifname accept
                jump common_input_filter
        }

        chain forward {
                type filter hook forward priority 0; policy drop;
                iif $lo_ifname accept
                iif $lan_ifname accept
                iif $wan_ifname jump common_input_filter
                iif $wan_ifname ip daddr $server0_ipv4_addr tcp dport $server0_open_tcp_ports accept
                iif $wan_ifname ip daddr $server0_ipv4_addr udp dport $server0_open_udp_ports accept
        }

        chain output {
                type filter hook output priority 0; policy accept;
        }
}