define icmp_protos = { ipv6-icmp, icmp, igmp } table arp filter { limit lim_arp { rate over 50 mbytes/second burst 50 mbytes } counter arp-rx {} counter arp-tx {} counter arp-ratelimit-rx {} counter arp-ratelimit-tx {} chain input { type filter hook input priority filter policy accept limit name lim_arp counter name arp-ratelimit-rx drop counter name arp-rx } chain output { type filter hook output priority filter policy accept limit name lim_arp counter name arp-ratelimit-tx drop counter name arp-tx } } table inet filter { limit lim_reject { rate over 1000/second burst 1000 packets } limit lim_icmp { rate over 50 mbytes/second burst 50 mbytes } counter invalid-fw {} counter reject-ratelimit-fw {} counter reject-fw {} counter reject-tcp-fw {} counter reject-icmp-fw {} counter invalid-rx {} counter rx-lo {} counter invalid-local4-rx {} counter invalid-local6-rx {} counter icmp-ratelimit-rx {} counter icmp-rx {} counter ssh-rx {} counter mosh-rx {} counter wg-rx {} counter yggdrasil-gre-rx {} counter quickserve-rx {} counter established-rx {} counter reject-ratelimit-rx {} counter reject-rx {} counter reject-tcp-rx {} counter reject-icmp-rx {} counter tx-lo {} counter icmp-ratelimit-tx {} counter icmp-tx {} counter ssh-tx {} counter mosh-tx {} counter wg-tx {} counter yggdrasil-gre-tx {} counter quickserve-tx {} counter tx {} chain forward { type filter hook forward priority filter policy drop ct state invalid log level debug prefix "drop invalid forward: " counter name invalid-fw drop iifname lo counter name fw-lo accept limit name lim_reject log level debug prefix "drop forward: " counter name reject-ratelimit-fw drop log level debug prefix "reject forward: " counter name reject-fw meta l4proto tcp ct state new counter name reject-tcp-fw reject with tcp reset ct state new counter name reject-icmp-fw reject } chain input { type filter hook input priority filter policy drop ct state invalid log level debug prefix "drop invalid input: " counter name invalid-rx drop iifname lo counter name rx-lo accept iif != lo ip daddr 127.0.0.1/8 counter name invalid-local4-rx reject iif != lo ip6 daddr ::1/128 counter name invalid-local6-rx reject meta l4proto $icmp_protos limit name lim_icmp counter name icmp-ratelimit-rx drop meta l4proto $icmp_protos counter name icmp-rx accept tcp dport 22 counter name ssh-rx accept udp dport 60001-61000 counter name mosh-rx accept tcp dport 8000 counter name quickserve-rx accept udp dport 51820-51822 counter name wg-rx accept iifname "yggdrasil-wg-*" meta l4proto gre counter name yggdrasil-gre-rx accept ct state {established, related} counter name established-rx accept limit name lim_reject log level debug prefix "drop input: " counter name reject-ratelimit-rx drop log level debug prefix "reject input: " counter name reject-rx meta l4proto tcp ct state new counter name reject-tcp-rx reject with tcp reset ct state new counter name reject-icmp-rx reject } chain output { type filter hook output priority filter policy accept oifname lo counter name tx-lo accept meta l4proto $icmp_protos limit name lim_icmp counter name icmp-ratelimit-tx drop meta l4proto $icmp_protos counter name icmp-tx accept tcp sport 22 counter name ssh-tx udp sport 60001-61000 counter name mosh-tx udp sport 51820-51822 counter name wg-tx iifname "yggdrasil-wg-*" meta l4proto gre counter name yggdrasil-gre-tx tcp sport 8000 counter name http-tx accept counter name tx } }