# Scope: single homed edge host, symmetric uplink, no forwarding.
# IPv6 via RA or static config, no DHCPv6. HTTP/3 (udp 443) stays
# disabled on purpose. Add a udp rule when QUIC lands.
#
# Required sysctls (SYNPROXY prerequisites):
# net.netfilter.nf_conntrack_tcp_loose = 0
# net.ipv4.tcp_syncookies = 1
# net.ipv4.tcp_timestamps = 1
#
# Hardening sysctls (second line of defense, the ruleset drops these too):
# net.ipv4.conf.all.accept_redirects = 0
# net.ipv4.conf.default.accept_redirects = 0
# net.ipv6.conf.all.accept_redirects = 0
# net.ipv6.conf.default.accept_redirects = 0
#
# MSS and wscale in the synproxy objects MUST match the measured SYN/ACK
# of the backend.

define web_ports = { 80, 443 }

table inet edge {
    synproxy sp4 { mss 1460; wscale 7; timestamp sack-perm; }
    synproxy sp6 { mss 1440; wscale 7; timestamp sack-perm; }

    # Fail closed: SSH stays unreachable until trusted addresses are added.
    # Set contents are runtime state. A ruleset reload empties this set, so
    # the deployment tooling must repopulate it after every load, e.g.
    #   nft add element inet edge mgmt_v4 { 203.0.113.0/28 }
    set mgmt_v4 {
        type ipv4_addr
        flags interval
        comment "Trusted SSH source addresses and prefixes"
    }

    # Sized for admin networks up to /24. Grow size together with mgmt_v4:
    # sources beyond the size limit fail closed on new SSH connections.
    set ssh4_rate {
        type ipv4_addr
        flags dynamic,timeout
        size 256
        timeout 1m
    }

    chain pre {
        type filter hook prerouting priority raw; policy accept;

        # Strict RPF. Valid only for the documented symmetric single uplink topology.
        meta nfproto ipv4 fib saddr . iif oif missing counter drop

        # IPv6: permit DAD probes sent from the unspecified address, and keep
        # link local sources out of the fib check. fib lookups for fe80 are
        # kernel dependent and NDP must never hang on them. The input chain
        # still validates all link local traffic by source and hop limit.
        ip6 saddr :: icmpv6 type nd-neighbor-solicit ip6 hoplimit 255 accept
        ip6 saddr != fe80::/10 fib saddr . iif oif missing counter drop

        # Only bare SYNs to the local web service enter SYNPROXY.
        fib daddr type local tcp dport $web_ports \
            tcp flags & (fin | syn | rst | ack) == syn notrack
    }

    chain in {
        type filter hook input priority filter; policy drop;

        iifname "lo" accept

        # Explicit policy: this public edge accepts no ICMP Redirects, v4 or
        # v6. Placed before the established,related accept on purpose: v4
        # conntrack classifies redirects as related errors, and the v6 rule
        # must not depend on how a given kernel tracks NDP. The counters make
        # incoming redirect attempts visible.
        icmp type redirect counter drop
        icmpv6 type nd-redirect counter drop

        ct state established,related accept

        # Protocol critical ICMP stays unlimited on purpose. A shared limit
        # would let a flood of one type starve PMTUD messages of another.
        # Only echo is rate limited.
        icmp type { destination-unreachable, time-exceeded, parameter-problem } accept
        icmp type echo-request limit rate 10/second burst 20 packets accept

        icmpv6 type { destination-unreachable, packet-too-big,
                      time-exceeded, parameter-problem } accept
        ip6 saddr fe80::/10 icmpv6 type nd-router-advert ip6 hoplimit 255 accept
        icmpv6 type { nd-neighbor-solicit, nd-neighbor-advert } ip6 hoplimit 255 accept
        ip6 saddr fe80::/10 icmpv6 type mld-listener-query ip6 hoplimit 1 accept
        icmpv6 type echo-request limit rate 10/second burst 20 packets accept

        # SSH: explicit allowlist plus an independent rate budget per source.
        # Add an equivalent mgmt_v6 set and rule once the admin network
        # speaks IPv6.
        ip saddr @mgmt_v4 tcp dport 22 \
            tcp flags & (fin | syn | rst | ack) == syn \
            update @ssh4_rate { ip saddr limit rate 6/minute burst 3 packets } accept

        meta nfproto ipv4 tcp dport $web_ports \
            ct state { invalid, untracked } synproxy name sp4
        meta nfproto ipv6 tcp dport $web_ports \
            ct state { invalid, untracked } synproxy name sp6

        ct state invalid counter drop
        counter drop
    }
}