7 files changed, 149 insertions, 0 deletions
diff --git a/bundles/firewall/files/etc/nftables.d/00-basic.nft b/bundles/firewall/files/etc/nftables.d/00-basic.nft
new file mode 100644
index 0000000..493ab38
--- /dev/null
+++ b/bundles/firewall/files/etc/nftables.d/00-basic.nft
@@ -0,0 +1,59 @@
+#!/usr/sbin/nft -f
+# vim: set ts=4 sw=4:
+table inet filter {
+	chain input {
+		iifname lo accept \
+		comment "Accept any localhost traffic"
+
+		ct state { established, related } accept \
+		comment "Accept traffic originated from us"
+
+		ct state invalid drop \
+		comment "Drop invalid connections"
+
+		tcp dport 113 reject with icmpx type port-unreachable \
+		comment "Reject AUTH to make it fail fast"
+
+		# ICMPv4
+
+		ip protocol icmp icmp type {
+			echo-reply,  # type 0
+			destination-unreachable,  # type 3
+			echo-request,  # type 8
+			time-exceeded,  # type 11
+			parameter-problem,  # type 12
+		} accept \
+		comment "Accept ICMP"
+
+		# ICMPv6
+
+		icmpv6 type {
+			destination-unreachable,  # type 1
+			packet-too-big,  # type 2
+			time-exceeded,  # type 3
+			parameter-problem,  # type 4
+			echo-request,  # type 128
+			echo-reply,  # type 129
+		} accept \
+		comment "Accept basic IPv6 functionality"
+
+		icmpv6 type {
+			nd-router-solicit,  # type 133
+			nd-router-advert,  # type 134
+			nd-neighbor-solicit,  # type 135
+			nd-neighbor-advert,  # type 136
+		} ip6 hoplimit 255 accept \
+		comment "Allow IPv6 SLAAC"
+
+		icmpv6 type {
+			mld-listener-query,  # type 130
+			mld-listener-report,  # type 131
+			mld-listener-reduction,  # type 132
+			mld2-listener-report,  # type 143
+		} ip6 saddr fe80::/10 accept \
+		comment "Allow IPv6 multicast listener discovery on link-local"
+
+		ip6 saddr fe80::/10 udp sport 547 udp dport 546 accept \
+		comment "Accept DHCPv6 replies from IPv6 link-local addresses"
+	}
+}
diff --git a/bundles/firewall/files/etc/nftables.d/01-my-filter.nft b/bundles/firewall/files/etc/nftables.d/01-my-filter.nft
new file mode 100644
index 0000000..fffd9f2
--- /dev/null
+++ b/bundles/firewall/files/etc/nftables.d/01-my-filter.nft
@@ -0,0 +1,18 @@
+#!/usr/sbin/nft -f
+# vim: set ts=4 sw=4:
+table inet filter {
+
+	chain my_filter {
+	}
+
+	chain input {
+		jump my_filter
+		log prefix "blocked input traffic: " counter
+	}
+
+	chain forward {
+		jump my_filter
+		log prefix "blocked input traffic: " counter
+	}
+
+}
diff --git a/bundles/firewall/files/etc/nftables.d/10-tailscale.nft b/bundles/firewall/files/etc/nftables.d/10-tailscale.nft
new file mode 100644
index 0000000..f95e142
--- /dev/null
+++ b/bundles/firewall/files/etc/nftables.d/10-tailscale.nft
@@ -0,0 +1,16 @@
+#!/usr/sbin/nft -f
+# vim: set ts=4 sw=4:
+table inet filter {
+
+    chain my_filter {
+        iifname tailscale0 accept \
+        comment "Accept inbount tailscale traffic"
+
+        oifname tailscale0 accept \
+        comment "Accept outbound tailscale traffic"
+
+        udp dport { 41641 } accept \
+        comment "Accept tailscale NAT traffic"
+    }
+
+}
diff --git a/bundles/firewall/files/etc/nftables.d/22-ssh.nft b/bundles/firewall/files/etc/nftables.d/22-ssh.nft
new file mode 100644
index 0000000..c8c91a1
--- /dev/null
+++ b/bundles/firewall/files/etc/nftables.d/22-ssh.nft
@@ -0,0 +1,10 @@
+#!/bin/nft -f
+# vim: set ts=4 sw=4:
+table inet filter {
+
+    chain my_filter {
+        tcp dport { ${node.metadata.get("ssh/port", 22)} } accept \
+        comment "Accept SSH traffic"
+    }
+
+}
diff --git a/bundles/firewall/files/etc/nftables.d/50-www.nft b/bundles/firewall/files/etc/nftables.d/50-www.nft
new file mode 100644
index 0000000..6969f6d
--- /dev/null
+++ b/bundles/firewall/files/etc/nftables.d/50-www.nft
@@ -0,0 +1,10 @@
+#!/usr/sbin/nft -f
+# vim: set ts=4 sw=4:
+table inet filter {
+
+    chain my_filter {
+        tcp dport { http, https } accept \
+        comment "Accept HTTP traffic"
+    }
+
+}
diff --git a/bundles/firewall/files/etc/nftables.d/80-podman.nft b/bundles/firewall/files/etc/nftables.d/80-podman.nft
new file mode 100644
index 0000000..90142bc
--- /dev/null
+++ b/bundles/firewall/files/etc/nftables.d/80-podman.nft
@@ -0,0 +1,15 @@
+#!/usr/sbin/nft -f
+# vim: set ts=4 sw=4:
+table inet filter {
+
+    # HACK: this would not be necessary if not for the two chains being
+    # incompatible
+    chain my_filter {
+        ip daddr 10.89.0.0/24 ct state established,related accept \
+        comment "Accept incoming podman traffic"
+
+        ip saddr 10.89.0.0/24 accept \
+        comment "Accept outgoing podman traffic"
+    }
+
+}
diff --git a/bundles/firewall/files/etc/nftables.nft b/bundles/firewall/files/etc/nftables.nft
new file mode 100644
index 0000000..35b10dd
--- /dev/null
+++ b/bundles/firewall/files/etc/nftables.nft
@@ -0,0 +1,21 @@
+#!/usr/sbin/nft -f
+# vim: set ts=4 sw=4:
+# You can find examples in /usr/share/nftables/.
+
+# Clear all prior state
+flush ruleset
+
+# Basic IPv4/IPv6 stateful firewall for server/workstation.
+table inet filter {
+
+	chain input   { type filter hook input priority 0;   policy drop; }
+	chain forward { type filter hook forward priority 0; policy drop; }
+	chain output  { type filter hook output priority 0;  policy accept; }
+
+}
+
+# The state of stateful objects saved on the nftables service stop.
+include "/var/lib/nftables/*.nft"
+
+# Rules
+include "/etc/nftables.d/*.nft"