#!/usr/sbin/nft -f

flush ruleset

define IPv4_BOGONS = {
	0.0.0.0/8,
	10.0.0.0/8,
	100.64.0.0/10,
	127.0.0.0/8,
	169.254.0.0/16,
	172.16.0.0/12,
	192.0.0.0/24,
	192.0.2.0/24,
	192.168.0.0/16,
	198.18.0.0/15,
	198.51.100.0/24,
	203.0.113.0/24,
	224.0.0.0/3
}

define RFC1918_Local = {
	192.168.0.0/16,
	172.16.0.0/12,
	10.0.0.0/8
}

define Allowed_DNS = {
	9.9.9.11
}
define INTERNAL_DNS_PROXIES = {
	172.20.10.9,
	172.20.20.9,
	172.20.30.9,
	172.20.40.9
}

define VL10_USER_NET = {
	192.168.10.128/26
}
define VL20_USER_NET = {
	192.168.20.128/26
}
define VL30_USER_NET = {
	192.168.30.128/26
}
define VL40_USER_NET = {
	192.168.40.128/26
}
define VL90_USER_NET = {
	192.168.90.128/26
}
define VL90_CORE_NET = {
	192.168.90.4/32
}

define DOCKER_BRIDGES = {
	172.18.0.0/16,	#default
	172.20.0.0/16	#custom
}


#Refs:
#https://blog.samuel.domains/blog/security/nftables-hardening-rules-and-good-practices

table bridge nat {
	chain prerouting {
		type filter hook forward priority -300; policy accept;

		meta nftrace set 1;
	}
}

table bridge filter {
	chain input {
		type filter hook forward priority -200; policy drop;

		ether type 0x0806 accept;

		#Allow communication between the DNS server and the DNS proxies.
		ip saddr 172.20.10.5 ip daddr 172.20.10.9 udp dport 5353 ct state { new } accept;
		ip daddr 172.20.10.5 ip saddr 172.20.10.9 udp sport 5353 ct state { established } accept;

		ip saddr 172.20.20.5 ip daddr 172.20.20.9 udp dport 5353 ct state { new } accept;
		ip daddr 172.20.20.5 ip saddr 172.20.20.9 udp sport 5353 ct state { established } accept;

		ip saddr 172.20.30.5 ip daddr 172.20.30.9 udp dport 5353 ct state { new } accept;
		ip daddr 172.20.30.5 ip saddr 172.20.30.9 udp sport 5353 ct state { established } accept;

		ip saddr 172.20.40.5 ip daddr 172.20.40.9 udp dport 5353 ct state { new } accept;
		ip daddr 172.20.40.5 ip saddr 172.20.40.9 udp sport 5353 ct state { established } accept;

		meta nftrace set 1;

	}

	chain forward {
		type filter hook forward priority -200; policy drop;

		ether type 0x0806 accept;

		ip saddr 172.20.10.5 ip daddr 172.20.10.9 udp dport 5353 ct state { new } accept;
		ip daddr 172.20.10.5 ip saddr 172.20.10.9 udp sport 5353 ct state { established } accept;

		ip saddr 172.20.20.5 ip daddr 172.20.20.9 udp dport 5353 ct state { new } accept;
		ip daddr 172.20.20.5 ip saddr 172.20.20.9 udp sport 5353 ct state { established } accept;

		ip saddr 172.20.30.5 ip daddr 172.20.30.9 udp dport 5353 ct state { new } accept;
		ip daddr 172.20.30.5 ip saddr 172.20.30.9 udp sport 5353 ct state { established } accept;

		ip saddr 172.20.40.5 ip daddr 172.20.40.9 udp dport 5353 ct state { new } accept;
		ip daddr 172.20.40.5 ip saddr 172.20.40.9 udp sport 5353 ct state { established } accept;

		meta nftrace set 1;
	}

	chain postrouting {
		type filter hook forward priority 300; policy accept;

		meta nftrace set 1;
	}
}


table inet filter {
	chain input {
		type filter hook input priority 0; policy drop;


	#Packets from a Docker container bridged network to the bridge gateway
	#	go to the input chain.

	#Allow ARP.
	ether type 0x0806 accept;

	#Allow SSH
	ip saddr $VL90_USER_NET tcp dport 22 ct state { new, established } accept;

	#Internet repies. What's the ethertype? 0x0800 doesn't match.
	ip saddr != $RFC1918_Local ct state established accept;

	}


	chain forward {
		type filter hook forward priority 0; policy drop;

		meta nftrace set 1


	ether type 0x0806 accept;

	#####  DNS  #####
	#dnsproxy to internet. Encrypted so don't send to IPS.
	ether type 0x0800 ip saddr $INTERNAL_DNS_PROXIES ip daddr $Allowed_DNS udp dport 8443 ct state new ip length <= 400 accept;

	#Internet to dnsproxy. Encrypted so don't send to IPS.
	ip saddr $Allowed_DNS ip daddr $INTERNAL_DNS_PROXIES udp sport 8443 ct state established accept;

	#Initial DNS query.
	ether type 0x0800 ip saddr $VL10_USER_NET ip daddr 172.20.10.5 udp dport 5300 accept;
	ether type 0x0800 ip saddr $VL20_USER_NET ip daddr 172.20.20.5 udp dport 5300 accept;
	ether type 0x0800 ip saddr $VL30_USER_NET ip daddr 172.20.30.5 udp dport 5300 accept;
	ether type 0x0800 ip saddr $VL40_USER_NET ip daddr 172.20.40.5 udp dport 5300 accept;

	#DNS proxies to internet.
	ether type 0x0800 ip saddr $INTERNAL_DNS_PROXIES ip daddr $Allowed_DNS udp dport 8443 accept;

	#Internet to DNS proxies.
	ip daddr $INTERNAL_DNS_PROXIES ip saddr $Allowed_DNS udp sport 8443 accept;

	#DNS replies.
	ether type 0x0800 ip daddr $VL10_USER_NET ip saddr 172.20.10.5 udp sport 5300 accept;
	ether type 0x0800 ip daddr $VL20_USER_NET ip saddr 172.20.20.5 udp sport 5300 accept;
	ether type 0x0800 ip daddr $VL30_USER_NET ip saddr 172.20.30.5 udp sport 5300 accept;
	ether type 0x0800 ip daddr $VL40_USER_NET ip saddr 172.20.40.5 udp sport 5300 accept;


	#Allow generic internet access.
	#Don't pass these to an IPS as there is too much which would not be scanned and still take up CPU time.
	ether type 0x0800 ip saddr $VL10_USER_NET ip daddr != $RFC1918_Local ct state {new, established} accept;
	ether type 0x0800 ip saddr $VL20_USER_NET ip daddr != $RFC1918_Local ct state {new, established} accept;
	ether type 0x0800 ip saddr $VL30_USER_NET ip daddr != $RFC1918_Local ct state {new, established} accept;
	ether type 0x0800 ip saddr $VL40_USER_NET ip daddr != $RFC1918_Local ct state {new, established} accept;

	#What's the ethertype along here?
	ip saddr != $RFC1918_Local ip daddr $VL10_USER_NET ct state established accept;
	ip saddr != $RFC1918_Local ip daddr $VL20_USER_NET ct state established accept;
	ip saddr != $RFC1918_Local ip daddr $VL30_USER_NET ct state established accept;
	ip saddr != $RFC1918_Local ip daddr $VL40_USER_NET ct state established accept;

	}
	chain output {
		type filter hook output priority 0; policy accept;


	}
}

table inet nat {
	chain prerouting {
		type nat hook prerouting priority -100; policy accept;

		meta nftrace set 1

		#DNS in Docker bridge.
		ip saddr $VL10_USER_NET ip daddr 192.168.10.4 udp dport { 53 } dnat to 172.20.10.5:5300;
		ip saddr $VL20_USER_NET ip daddr 192.168.20.4 udp dport { 53 } dnat to 172.20.20.5:5300;
		ip saddr $VL30_USER_NET ip daddr 192.168.30.4 udp dport { 53 } dnat to 172.20.30.5:5300;
		ip saddr $VL40_USER_NET ip daddr 192.168.40.4 udp dport { 53 } dnat to 172.20.40.5:5300;
	}

	chain postrouting {
		type nat hook postrouting priority 100; policy accept;

		meta nftrace set 1

		oifname "ppp0" masquerade;
		iifname "br-3e4d90a574de" masquerade;
	}
}

table inet mangle {
	chain prerouting {
		type filter hook prerouting priority -150;

		meta nftrace set 1

		# CT INVALID
		ct state invalid counter drop

		# TCP SYN (CT NEW)
		tcp flags & (fin|syn|rst|ack) != syn ct state new counter drop

		#Block all unsolicited
		ip saddr != $IPv4_BOGONS ct state new drop
	}

    chain forward {
        type filter hook forward priority mangle; policy accept;
		#Seems to fix the website timeout issue.
		#https://unix.stackexchange.com/questions/672742/why-mss-clamping-in-iptables-nft-seems-to-take-no-effect-in-nftables
        meta l4proto tcp tcp flags & (syn|rst) == syn counter packets 0 bytes 0 tcp option maxseg size set rt mtu
    }
}


table netdev filterearly_wan {
	chain ingress {
		type filter hook ingress device enx7cc2c643f225 priority -500; policy accept;

	#Drop fragmented packets.
	ip frag-off & 0x1fff != 0 counter drop

	# TCP XMAS
	tcp flags & (fin|syn|rst|psh|ack|urg) == fin|syn|rst|psh|ack|urg counter drop

	# TCP NULL
	tcp flags & (fin|syn|rst|psh|ack|urg) == 0x0 counter drop

	# TCP MSS
	tcp flags syn tcp option maxseg size 1-536 counter drop

	#Filter BOGONS. This will also filter out spoofed local addresses.
	ip saddr $IPv4_BOGONS counter drop


	}
}

table netdev filterearly_lan {
	chain ingress {
		type filter hook ingress device enp1s0 priority -500; policy drop;

	#meta nftrace set 1

	#Traffic coming in here must be VLAN tagged.
	ether type 0x0800 drop;

	ether type 0x8100 vlan type arp accept;	#ARP



	#Must perform Docker filtering here.
	##  DNS  ##
	#Allow access to the DNS servers in Docker.
	ether type 0x8100 vlan id 10 ip saddr $VL10_USER_NET ip daddr 192.168.10.4 udp dport 53 accept;
	ether type 0x8100 vlan id 20 ip saddr $VL20_USER_NET ip daddr 192.168.20.4 udp dport 53 accept;
	ether type 0x8100 vlan id 30 ip saddr $VL30_USER_NET ip daddr 192.168.30.4 udp dport 53 accept;
	ether type 0x8100 vlan id 40 ip saddr $VL40_USER_NET ip daddr 192.168.40.4 udp dport 53 accept;


	#Must go through internal DNS server(s).
	ether type 0x8100 vlan id 10 ip saddr $VL10_USER_NET ip daddr != 192.168.10.4 udp dport 53 drop;
	ether type 0x8100 vlan id 20 ip saddr $VL20_USER_NET ip daddr != 192.168.20.4 udp dport 53 drop;
	ether type 0x8100 vlan id 30 ip saddr $VL30_USER_NET ip daddr != 192.168.30.4 udp dport 53 drop;
	ether type 0x8100 vlan id 40 ip saddr $VL40_USER_NET ip daddr != 192.168.40.4 udp dport 53 drop;



	##  DHCP  ##
	#DISCOVER
	ether type 0x8100 ip saddr 0.0.0.0 ip daddr 255.255.255.255 udp sport 68 udp dport 67 ip length <= 590 accept;

	#OFFER controlled by EGRESS

	#RELEASE
	ether type 0x8100 vlan id 10 ip saddr 192.168.10.0/24 ip daddr 192.168.10.6 udp sport 68 udp dport 67 ip length <= 590 accept;
	ether type 0x8100 vlan id 20 ip saddr 192.168.20.0/24 ip daddr 192.168.20.6 udp sport 68 udp dport 67 ip length <= 590 accept;
	ether type 0x8100 vlan id 30 ip saddr 192.168.30.0/24 ip daddr 192.168.30.6 udp sport 68 udp dport 67 ip length <= 590 accept;
	ether type 0x8100 vlan id 40 ip saddr 192.168.40.0/24 ip daddr 192.168.40.6 udp sport 68 udp dport 67 ip length <= 590 accept;


	#Allow internet, but filter at FORWARD.
	ether type 0x8100 vlan id 10 ip saddr $VL10_USER_NET ip daddr != $RFC1918_Local accept;
	ether type 0x8100 vlan id 20 ip saddr $VL20_USER_NET ip daddr != $RFC1918_Local accept;
	ether type 0x8100 vlan id 30 ip saddr $VL30_USER_NET ip daddr != $RFC1918_Local accept;
	ether type 0x8100 vlan id 40 ip saddr $VL40_USER_NET ip daddr != $RFC1918_Local accept;

	#Only LAN traffic on VL90 (management)
	ether type 0x8100 vlan id 90 ip saddr $VL90_USER_NET ip daddr $VL90_CORE_NET accept;


	}
}