#!/usr/bin/nft -f
# vim:set ts=2 sw=2 et:

# IPv4/IPv6 default-deny firewall ruleset.

destroy table inet filter
table inet filter {
  chain input {
    type filter hook input priority filter
    policy drop

    ct state invalid drop comment "early drop of invalid connections"
    ct state {established, related} accept comment "allow tracked connections"
    iif lo accept comment "allow from loopback"
    meta l4proto { icmp, icmpv6 } accept comment "allow icmp"
    meta pkttype multicast udp dport 5353 accept comment "allow mDNS discovery"

    iifname "lxdbr0" udp dport 53 accept comment "LXD DNS"
    iifname "lxdbr0" tcp dport 53 accept comment "LXD DNS"
    iifname "lxdbr0" meta nfproto ipv4 udp dport 67 accept comment "LXD DHCPv4"
    iifname "lxdbr0" meta nfproto ipv6 udp dport 547 accept comment "LXD DHCPv6"

    pkttype host limit rate 5/second counter reject with icmpx type admin-prohibited
    counter
  }
  chain forward {
    type filter hook forward priority filter
    policy drop

    ct state invalid drop
    iifname "lxdbr0" accept comment "allow connections from LXD instances"
    oifname "lxdbr0" ct state {established, related} accept comment "allow replies to LXD instances"
  }
}