#!/usr/sbin/nft -f
# {{ ansible_managed }}
# Relais de {{ serveur_relais_site }} — role serveur_relais. Il ne decide d'aucun service : il fait
# suivre les adresses relayees vers {{ serveur_relais_pair_nom }}, qui filtre.
flush ruleset

define CONSOLE = {{ serveur_relais_console }}
define RELAYEES = { {{ serveur_relais_adresses_relayees | join(', ') }} }

table inet relais {
  chain input {
    type filter hook input priority filter; policy drop;
    ct state established,related accept
    ct state invalid drop
    iif lo accept
    udp sport 67 udp dport 68 accept comment "baux DHCP de l'hebergeur"
    ip protocol icmp icmp type { echo-request, destination-unreachable, time-exceeded } limit rate 10/second accept
    ip6 nexthdr ipv6-icmp icmpv6 type { nd-neighbor-solicit, nd-neighbor-advert, nd-router-advert, destination-unreachable, packet-too-big, time-exceeded } accept
    ip daddr $CONSOLE tcp dport 22 accept comment "console SSH"
    ip daddr $CONSOLE udp dport {{ serveur_relais_tunnel_port }} accept comment "tunnel de {{ serveur_relais_pair_nom }}"
    iifname "{{ serveur_relais_interface_tunnel }}" ip saddr {{ serveur_relais_pair_adresse }} icmp type echo-request accept comment "sonde de {{ serveur_relais_pair_nom }}"
    counter comment "refus en entree"
  }
  chain forward {
    type filter hook forward priority filter; policy drop;
    tcp flags syn tcp option maxseg size set rt mtu
    ct state established,related accept
    ct state invalid drop
    iifname "{{ serveur_relais_interface_publique }}" oifname "{{ serveur_relais_interface_tunnel }}" ip daddr $RELAYEES accept comment "Internet vers {{ serveur_relais_pair_nom }}"
    iifname "{{ serveur_relais_interface_tunnel }}" oifname "{{ serveur_relais_interface_publique }}" ip saddr $RELAYEES accept comment "{{ serveur_relais_pair_nom }} vers Internet, sources relayees seulement"
    counter comment "refus en transit"
  }
}