#!/usr/sbin/nft -f
# Managed by Ansible — Set-OPS

flush ruleset

table inet setops_filter {
  chain input {
    type filter hook input priority 0; policy {{ nftables_baseline_input_policy }};

    iif "lo" accept
    ct state established,related accept
    ct state invalid drop

{% if nftables_baseline_allow_icmp | bool %}
    ip protocol icmp accept
    ip6 nexthdr icmpv6 accept
{% endif %}

{% if nftables_baseline_allow_ssh | bool %}
    tcp dport {{ nftables_baseline_ssh_port }} accept
{% endif %}

{% for port in nftables_baseline_extra_tcp_ports %}
    tcp dport {{ port }} accept
{% endfor %}

{% for port in nftables_baseline_extra_udp_ports %}
    udp dport {{ port }} accept
{% endfor %}
  }

  chain forward {
    type filter hook forward priority 0; policy {{ nftables_baseline_forward_policy }};
  }

  chain output {
    type filter hook output priority 0; policy {{ nftables_baseline_output_policy }};
  }
}