ansible-sample/roles/nftables/templates/nftables_servers.conf.j2

#!/usr/sbin/nft -f

destroy table inet myfilter

# Network range
define LAN_IP4 = {{ nft_lan_ip4 }}
define LAN_IP6 = {{ nft_lan_ip6 }}

table inet myfilter {
	{% if nft_any_allow_elements is defined and nft_any_allow_elements %}
	# 開放するポート(from Any)
	set lan_allow_any {
		typeof meta l4proto . th dport
		flags interval
		elements = {
			{% for element in nft_any_allow_elements %}
			{% set entry = element.proto_port ~ "," %}
			{% set tabs = 3 - (((entry | length) / 8) | int) %}
			{{ entry }}{{ "	" * tabs }}# {{ element.comment }}
			{% endfor %}
		}
	}

	{% endif %}
	{% if nft_bload_allow_elements is defined and nft_bload_allow_elements %}
	# 開放するポート(from Bloadcast)
	set lan_allow_blo {
		typeof meta l4proto . th dport
		flags interval
		elements = {
			{% for element in nft_bload_allow_elements %}
			{% set entry = element.proto_port ~ "," %}
			{% set tabs = 3 - (((entry | length) / 8) | int) %}
			{{ entry }}{{ "	" * tabs }}# {{ element.comment }}
			{% endfor %}
		}
	}

	{% endif %}
	# 開放するポート(from LAN)
	set lan_allow_lan {
		typeof meta l4proto . th dport
		flags interval
		elements = {
			{% for element in nft_lan_allow_elements %}
			{% set entry = element.proto_port ~ "," %}
			{% set tabs = 3 - (((entry | length) / 8) | int) %}
			{{ entry }}{{ "	" * tabs }}# {{ element.comment }}
			{% endfor %}
		}
	}

	# このサーバーが受け取るパケットを判定して処理するチェーン
	chain input {
		type filter hook input priority filter; policy drop;

		iif lo accept

		# 不正パケットの破棄
		ct state invalid jump logging_invalid

		# 確立済みの通信を許可
		ct state established,related accept

		# ICMPの許可
		meta nfproto ipv4 icmp type {
			destination-unreachable, time-exceeded, parameter-problem,
			echo-reply, echo-request
		} accept

		meta nfproto ipv6 icmpv6 type {
			destination-unreachable, packet-too-big, time-exceeded, parameter-problem,
			echo-reply, echo-request,
			nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert,
			148, 149
		} accept

		ip6 saddr fe80::/10 icmpv6 type {
			130, 131, 132, 143, 151, 152, 153
		} accept

		# DHCPv6 Client
		ip6 saddr fe80::/10 udp dport 546 accept

		# 接続を許可
		{% if nft_any_allow_elements is defined and nft_any_allow_elements %}
		meta l4proto . th dport @lan_allow_any ct state new accept
		{% endif %}
		{% if nft_bload_allow_elements is defined and nft_bload_allow_elements %}
		meta l4proto . th dport @lan_allow_blo ct state new accept
		{% endif %}
		ip  saddr $LAN_IP4 meta l4proto . th dport @lan_allow_lan ct state new accept
		ip6 saddr $LAN_IP6 meta l4proto . th dport @lan_allow_lan ct state new accept

		# ブロックログ出力
		jump logging_input_block
	}

	# ブロックするけれどログを出力しないポート
	set input_silent {
		typeof meta l4proto . th dport
		flags interval
		elements = {
			{% for element in nft_input_silent_elements %}
			{% set entry = element.proto_port ~ "," %}
			{% set tabs = 3 - (((entry | length) / 8) | int) %}
			{{ entry }}{{ "	" * tabs }}# {{ element.comment }}
			{% endfor %}
		}
	}

	# 許可されない接続をログ出力するチェーン
	chain logging_input_block {
		# 無言ドロップ
		meta l4proto . th dport @input_silent drop
		# IGMPを無言ドロップ
		ip protocol igmp drop

		limit rate 3/minute burst 10 packets log prefix "[NFT INP-BLK] "
		drop
	}

	# ブロックするけれどログを出力しないポート
	set invalid_silent {
		typeof meta l4proto . th sport . th dport
		flags interval
		elements = {
			{% for element in nft_invalid_silent_elements %}
			{% set entry = element.proto_port ~ "," %}
			{% set tabs = 4 - (((entry | length) / 8) | int) %}
			{{ entry }}{{ "	" * tabs }}# {{ element.comment }}
			{% endfor %}
		}
	}

	# 不正なパケットをログ出力するチェーン
	chain logging_invalid {
		# 無言ドロップ
		meta l4proto . th sport . th dport @invalid_silent drop
		# 突然のWi-Fi切断で近隣検索が入った場合に対応
		icmpv6 type destination-unreachable drop

		limit rate 3/minute burst 10 packets log prefix "[NFT INVALID] "
		drop
	}
}