nix-router/networking/firewall.nft

#!/usr/sbin/nft -f

table inet global {
    flowtable f {
        hook ingress priority 0;
        devices = { ppp0, lan };
    }

    chain input {
        type filter hook input priority filter; policy drop;

        iifname lo accept
        iifname lan counter accept

        # iifname ppp0 udp dport { 546, 547 } accept  # IPv6 PD
        ip6 nexthdr icmpv6 icmpv6 type nd-router-solicit counter accept
        ip6 nexthdr icmpv6 icmpv6 type nd-router-advert counter accept
        udp dport dhcpv6-client udp sport dhcpv6-server counter accept comment "IPv6 DHCP"
        ct state { established, related } counter accept
        iifname ppp0 counter drop
    }

    chain forward {
        type filter hook forward priority filter; policy drop;
        # clamp MSS to PMTU
        tcp flags syn tcp option maxseg size set rt mtu
        # ip6 nexthdr tcp tcp flags syn tcp option maxseg size set rt mtu

        ip protocol { tcp, udp } flow offload @f
        ip6 nexthdr { tcp, udp } flow offload @f

        iifname lan counter accept comment "Allow lan -> *"
        iifname ppp0 oifname lan ct state { established, related } counter accept comment "Allow established back to lan"
        iifname ppp0 oifname lan counter drop
    }

    chain postrouting {
        type nat hook postrouting priority filter; policy accept;
        ip saddr 192.168.5.0/24 oifname ppp0 counter masquerade
    }
}


table ip clash {
    chain prerouting {
        type nat hook prerouting priority filter; policy accept;
        meta skuid clash counter return
        ip daddr 198.18.0.0/16 tcp dport 1-65535 counter redirect to :7893 comment "!chnroute -> clash (tcp)"
        ip daddr 198.18.0.0/16 udp dport 1-65535 meta mark set 0x233 tproxy to :7894 counter accept comment "!chnroute -> clash (udp)"
    }

    chain output {
        type nat hook output priority mangle; policy accept;
        meta skuid clash counter return
        ip daddr 198.18.0.0/16 tcp dport 1-65535 counter redirect to :7893 comment "!chnroute -> clash (tcp) [local]"
        ip daddr 198.18.0.0/16 udp dport 1-65535 meta mark set 0x233 counter comment "!chnroute -> clash (udp) [local]"
    }

    chain divert {
        type filter hook prerouting priority mangle; policy accept;
        ip protocol tcp socket transparent 1 meta mark set 0x233 counter accept
    }
}