Evernode.Forum

Code: Select all

#!/usr/sbin/nft -f

flush ruleset

define WAN = eth0
define HOME_WG = 10.50.0.2

table inet filter {
    chain input {
        type filter hook input priority filter;
        policy drop;

        iifname "lo" accept
        iifname "wg0" accept

        ct state established,related accept

        # SSH to VPS itself
        tcp dport 22 accept

        # WireGuard
        udp dport 51820 accept

        # Ping
        ip protocol icmp accept
    }

    chain forward {
        type filter hook forward priority filter;
        policy drop;

        ct state established,related accept

        # Home server -> Internet
        iifname "wg0" oifname $WAN accept

        # VPS:2273 -> Home:2273
        iifname $WAN oifname "wg0" ip daddr $HOME_WG tcp dport 8006 accept

        # HTTP/HTTPS
        iifname $WAN oifname "wg0" ip daddr $HOME_WG tcp dport { 80, 443 } accept

        # TCP/UDP service range
        iifname $WAN oifname "wg0" ip daddr $HOME_WG tcp dport 30111-32575 accept
        iifname $WAN oifname "wg0" ip daddr $HOME_WG udp dport 30111-32575 accept
    }

    chain output {
        type filter hook output priority filter;
        policy accept;
    }
}

table ip nat {
    chain prerouting {
        type nat hook prerouting priority dstnat;
        policy accept;

        # SSH to home server
        iifname $WAN tcp dport 8006 dnat to $HOME_WG:8006

        # HTTP/HTTPS
        iifname $WAN tcp dport 80 dnat to $HOME_WG:80
        iifname $WAN tcp dport 443 dnat to $HOME_WG:443

        # Preserve port numbers
        iifname $WAN tcp dport 30111-32575 dnat to $HOME_WG
        iifname $WAN udp dport 30111-32575 dnat to $HOME_WG
    }

    chain postrouting {
        type nat hook postrouting priority srcnat;
        policy accept;

        # Home outbound appears as VPS public IPv4
        oifname $WAN ip saddr $HOME_WG masquerade
    }
}