#!/usr/sbin/nft -f

table inet main_inet
flush table inet main_inet
delete table inet main_inet

table inet main_inet {
        chain input {
                type filter hook input priority 0;

                # Accept any localhost traffic.
                iif lo accept;

{% if system_base_interfaces_iifname %}
                # Accept any traffic on these interfaces.
                iifname { {{ system_base_interfaces_iifname | join(", ") }} } accept;

{% endif %}
                # Accept traffic originated from us.
                ct state established,related accept;

                # Allow ICMP packets.
                # Note that for IPv6 nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert are needed to not break connectivity.
                ip6 nexthdr icmpv6 icmpv6 type { echo-request, destination-unreachable, packet-too-big, time-exceeded, parameter-problem, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } accept;
                ip protocol icmp icmp type { echo-request, destination-unreachable, router-advertisement, time-exceeded, parameter-problem } accept;

                # Drop invalid connections.
                ct state invalid drop;

                # TCP ports.
                tcp dport { {{ [ansible_port] | union(system_base_additional_tcp_ports) | join(", ") }} } ct state new accept;

{% if system_base_udp_ports %}
                # UDP ports.
                udp dport { {{ system_base_udp_ports | join(", ") }} } accept;

{% endif %}
                # Count and drop any other traffic.
                counter drop;
        }
        chain forward {
                type filter hook forward priority 0;
        }
        chain output {
                type filter hook output priority 0;
        }
}