#!/usr/sbin/nft -f

flush ruleset

table inet filter {

  chain input {
    type filter hook input priority 0;
    policy drop;

    meta nftrace set 1

    ct state established,related accept
    iif "lo" accept

    # Autoriser les réponses des serveurs WireGuard vers notre client
    iifname "wlp1s0" udp sport 51820 accept
    
    # Handshakes WireGuard sur wlan0
    iifname "wlp1s0" udp dport 51820 accept
    iifname "wlp1s0" udp dport 51821 accept

    # Proton
    iifname "wg0" udp dport 53 accept
    iifname "wg0" tcp dport 53 accept
    iifname "wg0" tcp dport 80 accept
    iifname "wg0" tcp dport 443 accept

    # LAN local
    iifname "wlp1s0" ip saddr 192.168.1.0/24 accept

    # VMs -> dnsmasq
    iifname "virbr0" udp dport { 53, 67, 68 } accept
    iifname "virbr0" tcp dport 53 accept

    iifname "virbr0" ct state established,related accept
    iifname "virbr0" ip daddr 192.168.122.1 accept   
    
    iifname "vmnet8" tcp dport {139,445} accept
    iifname "vmnet8" udp dport {137,138} accept
    iifname "vmnet1" tcp dport {139,445} accept
    iifname "vmnet1" udp dport {137,138} accept

    meta nfproto ipv6 drop  
  }

  chain forward {
    type filter hook forward priority 0;
    policy drop;

    # VMs -> Proton
    iifname "virbr0" oifname "wg0" accept
    iifname "wg0" oifname "virbr0" ct state established,related accept

    # VMs -> LAN
    iifname "virbr0" oifname "wlp1s0" accept
    iifname "wlp1s0" oifname "virbr0" ct state established,related accept

    iifname "virbr0" oifname "virbr0" accept 
}

  chain output {
    type filter hook output priority 0;
    policy drop;

    meta nftrace set 1

    oif "lo" accept   
    
    # Autoriser ping via Proton wg0
    oifname "wg0" ip protocol icmp accept

    # DNS via Proton wg0
    oifname "wg0" udp dport 53 accept
    oifname "wg0" tcp dport 53 accept

    # HTTP / HTTPS via Proton wg0 (pacman, web, etc.)
    oifname "wg0" tcp dport 80 accept
    oifname "wg0" tcp dport 443 accept
    oifname "wg0" tcp dport 2222 accept
    oifname "wg0" tcp dport 2223 accept
    oifname "wg0" tcp dport { 993, 587 } accept

    oifname "wg0" udp dport 123 accept

    # Handshakes WG via wlan0
    oifname "wlp1s0" udp dport 51820 accept
    oifname "wlp1s0" udp dport 51821 accept

    # sortie SSH 2222 vers le LAN
    oifname "wlp1s0" ip daddr 192.168.1.0/24 tcp dport 2222 accept
    oifname "wlp1s0" ip daddr 86.237.184.253 tcp dport 2222 accept
    oifname "wlp1s0" ip daddr 192.168.1.0/24 tcp dport 2223 accept
    oifname "wlp1s0" ip daddr 86.237.184.253 tcp dport 2223 accept

    # Accès à l'interface de la box (192.168.1.1) via le LAN
    oifname "wlp1s0" ip daddr 192.168.1.1 tcp dport { 80, 443, 2222, 2223} accept
    oifname "wlp1s0" ip daddr 192.168.1.1 icmp type echo-request accept
    oifname "wlp1s0" ip daddr 192.168.1.0/24 accept
    
    oifname "vmnet8" accept
    oifname "vmnet1" accept

    # Handshakes WG qui passeraient DANS le tunnel Proton (si c'est voulu)
    oifname "wg0" udp dport 51820 accept
    oifname "wg0" udp dport 51821 accept
    
    oifname "virbr0" accept
    
    meta nfproto ipv6 drop
  }
}

table ip nat {
  chain postrouting {
    type nat hook postrouting priority srcnat; policy accept;
    ip saddr 192.168.122.0/24 oifname "wg0" masquerade
  }
}