#!/usr/sbin/nft -f

flush ruleset

table inet filter {
	set home_net {
		type ipv4_addr
		flags interval
		comment "Home subnet"
		elements = {100.222.5.0/24}
	} 
	set iot_net {
		type ipv4_addr
		flags interval
		comment "iOT subnet"
		elements = {100.222.6.0/24}
	} 
	set vpn_net {
		type ipv4_addr
		flags interval
		comment "iOT subnet"
		elements = {100.222.11.0/24}
	} 

	chain input {
		type filter hook input priority filter; policy drop;

		iif lo accept comment "Accept any localhost trafic"
		ct state invalid drop comment "Drop invalid connection"
		fib daddr . iif type != {local, broadcast, multicast} drop
		ct state { established, related } accept

		#meta l4proto { icmp, ipv6-icmp } accept comment "Accept ICMP"

		tcp dport 22 accept comment "Allow ssh connection from home subnet"
		ip saddr @vpn_net tcp dport 53 accept comment "Allow ssh connection from home subnet"

		ip saddr @vpn_net udp dport 53 accept comment "Allow ssh connection from home subnet"
		udp dport {{ wireguard_port }} accept comment "Wireguard port"
	}
	chain forward {
		type filter hook forward priority filter;
	}
	chain output {
		type filter hook output priority filter;
	}
}