#!/usr/sbin/nft -f

flush ruleset

define ip6_mask = ffff:ffff:ffff:ffff::
define public_http = 8080
define public_https = 8443
define public_ssh = 3222
define system_ssh = 49152

table inet nat {
  chain prerouting {
    type nat hook prerouting priority dstnat; policy accept;

    tcp dport 80 redirect to :$public_http
    tcp dport 443 redirect to :$public_https
    tcp dport 22 redirect to :$public_ssh
  }
}


table inet firewall {
  set ssh_ratelimit_v4 {
    type ipv4_addr
    size 65535
    flags dynamic,timeout
    timeout 60m
  }

  set ssh_ratelimit_v6 {
    type ipv6_addr
    size 65535
    flags dynamic,timeout
    timeout 60m
  }

  set blackhole_v4 {
    type ipv4_addr
    size 65535
    flags dynamic,timeout
    timeout 24h
  }

  set blackhole_v6 {
    type ipv6_addr
    size 65535
    flags dynamic,timeout
    timeout 24h
  }

  set public_ssh_ratelimit_v4 {
    type ipv4_addr
    size 65535
    flags dynamic,timeout
    timeout 10m
  }

  set public_ssh_ratelimit_v6 {
    type ipv6_addr
    size 65535
    flags dynamic,timeout
    timeout 10m
  }

  set public_ssh_connections_v4 {
    type ipv4_addr
    size 65535
    flags dynamic
  }

  set public_ssh_connections_v6 {
    type ipv6_addr
    size 65535
    flags dynamic
  }

  chain inbound_rules_v4 {
    icmp type echo-request limit rate 15/second accept
  }

  chain inbound_rules_v6 {
    icmpv6 type { nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } accept
    icmpv6 type echo-request limit rate 15/second accept
  }

  chain inbound_system_ssh_v4 {
    ct state new tcp dport $system_ssh add @ssh_ratelimit_v4 \
      { ip saddr limit rate 1/hour burst 1 packets } counter accept

    counter drop
  }

  chain inbound_system_ssh_v6 {
    ct state new tcp dport $system_ssh add @ssh_ratelimit_v6 \
      { ip6 saddr & ffff:ffff:ffff:ffff:: limit rate 1/hour burst 1 packets } counter accept

    counter drop
  }

  chain inbound_public_ssh_v4 {
    # Set a concurrent cap for each ip
    tcp dport $public_ssh ct state new add @public_ssh_connections_v4 { ip saddr ct count over 4 } counter reject with tcp reset

    # Set a per ip connection ratelimit
    tcp dport $public_ssh ct state new update @public_ssh_ratelimit_v4 { ip saddr limit rate over 20/minute burst 5 packets } counter reject with tcp reset

    tcp dport $public_ssh accept
    counter drop
  }

  chain inbound_public_ssh_v6 {
    # Set a concurrent cap for each ip
    tcp dport $public_ssh ct state new add @public_ssh_connections_v6 { ip6 saddr & $ip6_mask ct count over 4 } counter reject with tcp reset

    # Set a per ip connection ratelimit
    tcp dport $public_ssh ct state new update @public_ssh_ratelimit_v6 { ip6 saddr & $ip6_mask limit rate over 20/minute burst 5 packets } counter reject with tcp reset
    
    tcp dport $public_ssh accept
    counter drop
  }

  chain inbound_blackhole_v4 {
    # blacklist tcp traffic for 24h
    ct state new tcp flags & (fin | syn | rst | ack) == syn update @blackhole_v4 \
      { ip saddr timeout 24h } counter drop

    # blacklist udp traffic
    ct state new meta l4proto udp update @blackhole_v4 \
      { ip saddr timeout 24h } counter drop

    counter drop
  }

  chain inbound_blackhole_v6 {
    # TCP SYN to any unauthorized port: blacklist the /64 for 24h.
    ct state new tcp flags & (fin | syn | rst | ack) == syn update @blackhole_v6 \
      { ip6 saddr & $ip6_mask timeout 24h } counter drop

    # UDP to any unauthorized port: blacklist the /64 for 24h.
    ct state new meta l4proto udp update @blackhole_v6 \
      { ip6 saddr & $ip6_mask timeout 24h } counter drop

    counter drop
  }

  chain inbound {
    type filter hook input priority filter; policy drop;
    
    # Allow specific networks to go unblocked
    iifname "lo" accept
    iifname "tailscale0" accept

    # Allow replies
    ct state vmap { invalid : drop, established : accept, related : accept }
     
    # Basic ping allowances
    meta nfproto ipv4 jump inbound_rules_v4
    meta nfproto ipv6 jump inbound_rules_v6

    # Allow service ports
    tcp dport { $public_http , $public_https } counter accept

    # Ratelimit service ssh port (3222)
    #   Global ssh connection rate limiter
    tcp dport $public_ssh ct state new limit rate over 120/minute burst 30 packets counter reject with tcp reset
    meta nfproto ipv4 tcp dport $public_ssh goto inbound_public_ssh_v4
    meta nfproto ipv6 tcp dport $public_ssh goto inbound_public_ssh_v6
    
    # Block likely bots
    ip saddr @blackhole_v4 counter drop
    ip6 saddr & $ip6_mask @blackhole_v6 counter drop

    # Fail2unban on vps' own ssh port
    meta nfproto ipv4 tcp dport $system_ssh goto inbound_system_ssh_v4
    meta nfproto ipv6 tcp dport $system_ssh goto inbound_system_ssh_v6

    # Decide to add ip to blackhole list (incase of bot)
    meta nfproto ipv4 goto inbound_blackhole_v4
    meta nfproto ipv6 goto inbound_blackhole_v6

    # Block other traffic (default to chain)
  }

  chain forward {
    type filter hook forward priority filter; policy drop;
  }
}