Configure nftables

machine.yml

@@ -28,6 +28,31 @@
       when:
         sshd_cfg is changed
 
+    # -------------------------------------------------------------------------
+    # Firewall configuration.
+    # -------------------------------------------------------------------------
+
+    - name: Install nftables
+      apt:
+        name: nftables
+      register: nftables_install
+
+    - name: Configure nftables
+      template:
+        src: ./root/etc/nftables.conf.j2
+        dest: /etc/nftables.conf
+        mode: 0755
+      register: nftables_cfg
+
+    - name: Enable/start/restart nftables
+      service:
+        name: nftables
+        state: restarted
+        enabled: yes
+      when:
+        nftables_install is changed or
+        nftables_cfg is changed
+
     # ----------------------------------------------------------------------------------------------
     # NTP configuration.
     # ----------------------------------------------------------------------------------------------

root/etc/nftables.conf.j2

@@ -5,6 +5,26 @@ flush ruleset
 table inet filter {
 	chain input {
 		type filter hook input priority 0;
+
+                # Accept any localhost traffic.
+                iif lo accept;
+
+                # Accept traffic originated from us.
+                ct state established,related accept;
+
+                # Allow ICMP packets.
+                # Note that for IPv6 nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert are needed to not break connectivity.
+                ip6 nexthdr icmpv6 icmpv6 type { echo-request, destination-unreachable, packet-too-big, time-exceeded, parameter-problem, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } accept;
+                ip protocol icmp icmp type { echo-request, destination-unreachable, router-advertisement, time-exceeded, parameter-problem } accept;
+
+		# Drop invalid connections.
+		ct state invalid drop;
+
+                # Activate the following line to accept common local services.
+                tcp dport { 80, 443, {{ ansible_port }} } ct state new accept;
+
+                # Count and drop any other traffic.
+                counter drop;
 	}
 	chain forward {
 		type filter hook forward priority 0;