1 files changed, 27 insertions, 10 deletions

diff --git a/hosts/surtr/ruleset.nft b/hosts/surtr/ruleset.nft
index ee72614f..5c2bba7c 100644
--- a/hosts/surtr/ruleset.nft
+++ b/hosts/surtr/ruleset.nft
@@ -86,6 +86,7 @@ table inet filter {
 
   counter established-rx {}
 
+  counter reject-mail-nologin {}
   counter reject-ratelimit-rx {}
   counter reject-rx {}
   counter reject-tcp-rx {}
@@ -114,6 +115,17 @@ table inet filter {
 
   counter tx {}
 
+  set mail_nologin4 {
+    type ipv4_addr
+    flags interval
+    auto-merge
+  }
+  set mail_nologin6 {
+    type ipv6_addr
+    flags interval
+    auto-merge
+  }
+
   chain forward {
     type filter hook forward priority filter
     policy drop
@@ -145,6 +157,14 @@ table inet filter {
     counter name drop-fw
   }
 
+  chain reject_input {
+    limit name lim_reject log level debug prefix "drop input: " counter name reject-ratelimit-rx drop
+    log level debug prefix "reject input: " counter name reject-rx
+    meta l4proto tcp ct state new counter name reject-tcp-rx reject with tcp reset
+    ct state new counter name reject-icmp-rx reject
+
+    counter name drop-rx
+  }
   chain input {
     type filter hook input priority filter
     policy drop
@@ -177,8 +197,11 @@ table inet filter {
     udp dport {3478, 5349} counter name stun-rx accept
     udp dport 49000-50000 counter name turn-rx accept
 
+    tcp dport {465,466,993,4190} ip saddr @mail_nologin4 log prefix "mail nologin: " counter name reject-mail-nologin jump reject_input
+    tcp dport {465,466,993,4190} ip6 saddr @mail_nologin6 log prefix "mail nologin: " counter name reject-mail-nologin jump reject_input
+
     tcp dport 25 counter name smtp-rx accept
-    tcp dport 465 counter name submissions-rx accept
+    tcp dport {465, 466} counter name submissions-rx accept
     tcp dport 993 counter name imaps-rx accept
     tcp dport 4190 counter name managesieve-rx accept
     iifname yggdrasil tcp dport 8432 counter name pgbackrest-rx accept
@@ -186,13 +209,7 @@ table inet filter {
     ct state {established, related} counter name established-rx accept
 
 
-    limit name lim_reject log level debug prefix "drop input: " counter name reject-ratelimit-rx drop
-    log level debug prefix "reject input: " counter name reject-rx
-    meta l4proto tcp ct state new counter name reject-tcp-rx reject with tcp reset
-    ct state new counter name reject-icmp-rx reject
-
-
-    counter name drop-rx
+    jump reject_input
   }
 
   chain output {
@@ -224,7 +241,7 @@ table inet filter {
     udp sport 49000-50000 counter name turn-tx accept
 
     tcp sport 25 counter name smtp-tx accept
-    tcp sport 465 counter name submissions-tx accept
+    tcp sport {465, 466} counter name submissions-tx accept
     tcp sport 993 counter name imaps-tx accept
     tcp sport 4190 counter name managesieve-tx accept
     tcp sport 8432 counter name pgbackrest-tx accept
@@ -232,4 +249,4 @@ table inet filter {
 
     counter name tx
   }
-}
\ No newline at end of file
+}