#!/usr/sbin/nft -f

flush ruleset

############################
# FILTER
############################
table inet filter {

    chain input {
        type filter hook input priority 0; policy drop;

        # Loopback
        iif lo accept

        # Conexoes ja estabelecidas
        ct state invalid drop
        ct state established,related accept
        tcp dport { 22, 80, 443 } ct state new accept

        # DHCP
        udp dport {67,68} accept

        ip protocol icmp accept
    }

    chain forward {
        type filter hook forward priority 0; policy drop;

        # Conexoes ja estabelecidas
        ct state invalid drop
        ct state established,related accept

        # LAN -> Internet
        iifname "eno2" oifname "enp3s0" accept

        # (Opcional) LAN -> LAN roteado
        iifname "eno2" oifname "eno2" accept

        # DHCP
        udp dport {67,68} accept

 # Ajuste de MSS (evita problemas de carregamento de páginas)
     tcp flags syn tcp option maxseg size set rt mtu

        ip protocol icmp accept
    }

    chain output {
        type filter hook output priority 0; policy drop;

        # Conexoes ja estabelecidas
        ct state invalid drop
        ct state established,related accept
        tcp dport { 22, 80, 443 } ct state new accept

        # DNS
        udp dport 53 accept
        tcp dport 53 accept

        # NTP/NTS
        udp dport 123 accept
        tcp dport 4460 accept

        # DHCP (cliente, se aplicavel)
        udp dport 67 accept
        udp sport 68 accept

        ip protocol icmp accept
    }
}

############################
# NAT
############################
table ip nat {

    chain prerouting {
        type nat hook prerouting priority 0;
    }

    chain postrouting {
        type nat hook postrouting priority 100;

        # Masquerade para a internet
        # oifname "enp3s0" masquerade
    }
}