# The rules around ramiel's end of the tunnel to halkyon.li (ADR 0039, D9, D17), loaded
# by wg-quick as the tunnel comes up and deleted as it goes (wg-halkyon.conf), so they
# live exactly as long as it. As /etc/wireguard/wg-halkyon.nft on ramiel (root, 0600).
#
# A table of their own, apart from ufw's: a packet the table drops is dropped whatever
# ufw says, and what it accepts still meets ufw's rules after it.
#
# - Into the tunnel: new connections to home's Caddy (443, from HAProxy) and sshd (22,
#   the jump from away), then their replies; nothing else.
# - From the tunnel: replies alone, so a taken-over home reaches neither ramiel's sshd
#   nor Forgejo nor anything else listening here.
# - Through the tunnel: nothing; ramiel routes nothing between it and anywhere else.
#
# IPv4 alone: the tunnel carries no IPv6 (D8).

# Made and deleted first, so loading this again replaces it whole.
table inet halkyon_tunnel {}
delete table inet halkyon_tunnel

table inet halkyon_tunnel {
	chain input {
		type filter hook input priority filter - 1; policy accept;
		iifname "wg-halkyon" ct state established,related accept
		iifname "wg-halkyon" drop
	}

	chain output {
		type filter hook output priority filter - 1; policy accept;
		oifname "wg-halkyon" ct state established,related accept
		oifname "wg-halkyon" ip daddr 10.61.97.2 tcp dport { 22, 443 } accept
		oifname "wg-halkyon" drop
	}

	chain forward {
		type filter hook forward priority filter - 1; policy accept;
		iifname "wg-halkyon" drop
		oifname "wg-halkyon" drop
	}
}