#! /sbin/nft -f
# Cases the importer must not get wrong (importer_test.go TestImportAudit).

define wan_if = "wan"
define lan_if = "enp2s0"
define iot_if = "enp2s0.20"
define admins = { 10.9.0.0/24 }

table inet audit {
	set blocklist {
		type ipv4_addr
		flags timeout
		timeout 1h
	}
	set lans {
		type ifname
		elements = { "enp2s0", "enp3s0" }
	}

	chain early {
		type filter hook input priority -10; policy accept;
		ip saddr 192.0.2.66 drop comment "an early input chain"
	}

	chain input {
		type filter hook input priority filter; policy drop;
		ct state established,related accept
		ip saddr @blocklist drop comment "dynamic"
		iifname @lans accept comment "an interface set"
		ip saddr 10.0.0.0/8 ip saddr != 10.0.10.0/24 tcp dport 22 drop comment "two source matches"
		icmpv6 type nd-neighbor-solicit ip6 hoplimit != 255 drop comment "hop limit not 255"
		iifname $iot_if udp dport 53 accept comment "DNS from the IoT VLAN"
		ip saddr $admins jump admin
	}

	chain admin {
		ip saddr 10.9.0.5 tcp dport 22 accept comment "within the jump"
		ip saddr 10.8.0.1 tcp dport 23 accept comment "outside the jump"
		meta mark 0x00000001 accept comment "raw under the jump"
	}

	chain forward {
		type filter hook forward priority filter; policy drop;
		ct state established,related accept
		ip daddr 10.0.10.37 tcp dport 443 accept comment "not only forwarded"
		iifname $lan_if oifname $wan_if accept
	}

	chain prerouting {
		type nat hook prerouting priority dstnat; policy accept;
		ip daddr 203.0.113.1 tcp dport { 80, 443 } dnat ip to 10.0.10.37 comment "web"
	}
}