main.ruleset

flush ruleset

table inet filter {
    chain INPUT {
        type filter hook input priority 0; policy drop;

        counter jump u-before-logging-input
        counter jump u-before-input
        counter jump u-after-input
        counter jump u-after-logging-input
        counter jump u-reject-input
        counter jump u-track-input
    }

    chain OUTPUT {
        type filter hook output priority 0; policy accept;

        counter jump u-before-logging-output
        counter jump u-before-output
        counter jump u-after-output
        counter jump u-after-logging-output
        counter jump u-reject-output
        counter jump u-track-output
    }

    chain FORWARD {
        type filter hook forward priority 0; policy drop;

        counter jump u-before-logging-forward
        counter jump u-before-forward
        counter jump u-after-forward
        counter jump u-after-logging-forward
        counter jump u-reject-forward
        counter jump u-track-forward
    }

    chain u-before-input {
        # allow all on loopback
        iifname lo counter accept

        # drop packets with RH0 headers
        rt type 0 counter drop

        # quickly process packets for which we already have a connection
        ct state related,established counter accept

        # multicast ping replies are part of the ok icmp codes for INPUT (rfc4890,
        # 4.4.1 and 4.4.2), but don't have an associated connection and are otherwise
        # be marked INVALID, so allow here instead.
        icmpv6 type echo-reply accept

        # drop INVALID packets (logs these in loglevel medium and higher)
        ct state invalid counter jump u-logging-deny
        ct state invalid counter drop

        # ok icmp codes for INPUT (rfc4890, 4.4.1 and 4.4.2)
        icmp   type { destination-unreachable, time-exceeded, parameter-problem, echo-request, echo-reply } accept
        icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, echo-request } accept
        icmpv6 type { nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } ip6 hoplimit 255 counter accept
        # IND solicitation, advertisement
        icmpv6 type { 141, 142 } ip6 hoplimit 255 accept
        # MLD query, report, done, report v2
        icmpv6 type { 130, 131, 132, 143 } ip6 saddr fe80::/10 accept
        # SEND certificate path solicitation, advertisement
        icmpv6 type { 148, 149 } ip6 hoplimit 255 accept
        # MR advertisement, solicitation, termination
        icmpv6 type { 151, 152, 153 } ip6 saddr fe80::/10 ip6 hoplimit 1 accept

        # Home Agent Address Discovery Request, Reply, Mobile Prefix Solicitation, Advertisement
        icmpv6 type { 144, 145, 146, 147 } accept

        # allow dhcp client to work
        udp sport 67  udp dport 68                                          counter accept
        udp sport 547 udp dport 546 ip6 daddr fe80::/10 ip6 saddr fe80::/10 counter accept

        # u-not-local
        counter jump u-not-local

        # allow MULTICAST mDNS for service discovery (be sure the MULTICAST below is uncommented)
        udp dport mdns ip  daddr 224.0.0.251 counter accept
        udp dport mdns ip6 daddr ff02::fb    counter accept

        # allow MULTICAST UPnP for service discovery (be sure the MULTICAST below is uncommented)
        udp dport 1900 ip  daddr 239.255.255.250 counter accept
        udp dport 1900 ip6 daddr ff02::f         counter accept

        # u-user-input
        counter jump u-user-input
    }

    chain u-before-output {
        # allow all on loopback
        oifname lo counter accept

        # drop packets with RH0 headers
        rt type 0 counter drop

        # quickly process packets for which we already have a connection
        ct state related,established counter accept

        # ok icmp codes for OUTPUT (rfc4890, 4.4.1 and 4.4.2)
        icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, echo-request, echo-reply } counter accept
        icmpv6 type { nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } ip6 hoplimit 255 counter accept
        # IND solicitation, advertisement
        icmpv6 type { 141, 142 } ip6 hoplimit 255 accept
        # MLD query, report, done, report v2
        icmpv6 type { 130, 131, 132, 143 } ip6 saddr fe80::/10 accept
        # SEND certificate path solicitation, advertisement
        icmpv6 type { 148, 149 } ip6 hoplimit 255 accept
        # MR advertisement, solicitation, termination
        icmpv6 type { 151, 152, 153 } ip6 saddr fe80::/10 ip6 hoplimit 1 accept

        # u-user-output
        counter jump u-user-output
    }

    chain u-before-forward {
        # drop packets with RH0 headers
        rt type 0 counter drop

        # quickly process packets for which we already have a connection
        ct state related,established counter accept

        # ok icmp code for FORWARD
        icmp   type { destination-unreachable, time-exceeded, parameter-problem, echo-request, echo-reply } accept
        icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, echo-request, echo-reply } accept

        # u-user-forward
        counter jump u-user-forward
    }

    chain u-after-input {
        # don't log noisy services by default
        udp dport { 67, 68, 137, 138 }   jump u-skip-to-policy-input
        tcp dport { 139, 445 }           jump u-skip-to-policy-input

        # don't log noisy broadcast
        fib daddr type broadcast counter jump u-skip-to-policy-input
    }

    chain u-after-output {
    }

    chain u-after-forward {
    }

    chain u-reject-input {
    }

    chain u-reject-output {
    }

    chain u-reject-forward {
    }

    chain u-track-input {
    }

    chain u-track-output {
        # Counter output
        meta l4proto {tcp, udp} ct state new counter accept
    }

    chain u-track-forward {
    }

    chain u-skip-to-policy-input {
        counter drop
    }

    chain u-skip-to-policy-output {
        counter accept
    }

    chain u-skip-to-policy-forward {
        counter drop
    }

    chain u-not-local {
        # if LOCAL, MULTICAST, BROADCAST return
        fib daddr type { local, multicast, broadcast } counter return

        # all other non-local packets are dropped
        limit rate 3/minute burst 10 packets counter jump u-logging-deny
        counter drop
    }

    chain u-logging-allow {
    }

    chain u-user-input {
    }

    chain u-user-output {
    }

    chain u-user-forward {
    }

    chain u-before-logging-input {
    }
    chain u-before-logging-output {
    }
    chain u-before-logging-forward {
    }

    chain u-after-logging-input {
    }
    chain u-after-logging-output {
    }
    chain u-after-logging-forward {
    }

    chain u-logging-deny {
    }
    chain u-logging-allow {
    }
}

#
# User rules
include "./user.ruleset"

#
#Logging
include "./log.ruleset"