#!/usr/sbin/nft -f
# Managed by Ansible — Set-OPS

flush ruleset

table inet chezlepro_filter {
  chain input {
    type filter hook input priority 0; policy {{ chezlepro_firewall_input_policy }};

    iif "lo" accept
    ct state established,related accept
    ct state invalid drop

{% if chezlepro_firewall_allow_icmp | bool %}
    ip protocol icmp accept
    ip6 nexthdr icmpv6 accept
{% endif %}

{% if chezlepro_firewall_allow_ssh | bool %}
    tcp dport {{ chezlepro_ssh_port }} accept
{% endif %}

{% for port in chezlepro_firewall_extra_tcp_ports %}
    tcp dport {{ port }} accept
{% endfor %}

{% for port in chezlepro_firewall_extra_udp_ports %}
    udp dport {{ port }} accept
{% endfor %}
  }

  chain forward {
    type filter hook forward priority 0; policy {{ chezlepro_firewall_forward_policy }};
  }

  chain output {
    type filter hook output priority 0; policy {{ chezlepro_firewall_output_policy }};
  }
}