define WAN = wan0 define LAN = lan0 table inet filter { chain input { type filter hook input priority filter; policy accept; iifname "lo" accept ct state invalid drop ct state { established, related } accept ip protocol icmpv6 accept ip protocol icmp accept meta l4proto ipv6-icmp accept tcp dport { 22 } accept comment "allow ssh to router" udp dport { 546, 53, 67 } accept comment "allow dhcpv6-client, dns, and dhcp" udp dport { 60000-60009 } accept comment "allow mosh common ports" drop } chain forward { type filter hook forward priority filter; policy accept; accept } chain output { type filter hook output priority filter; policy accept; accept } } table ip nat { chain postrouting { type nat hook postrouting priority 100; policy accept; oifname $LAN masquerade } chain prerouting { type nat hook prerouting priority -100; policy accept; # ip daddr 10.0.0.1 tcp dport { 80, 443 } dnat to 10.0.0.25 # faceless # allow HTTP, HTTPS, gitea's SSH, and host ssh to faceless iifname $WAN tcp dport { 443, 80, 2222, 2200 } dnat to 10.0.0.25 # allow mosh iifname $WAN udp dport 60010-60019 dnat to 10.0.0.25 # allow host ssh iifname $WAN tcp dport { 2221 } dnat to 10.0.0.10 # allow mosh iifname $WAN udp dport 60020-60029 dnat to 10.0.0.10 # ourcraft iifname $WAN tcp dport { 25565 } dnat to 10.0.0.244 } } # nat ipv4 for lan table ip io.systemd.nat { set masq_saddr { type ipv4_addr flags interval elements = { 10.0.0.0/24 } } map map_port_ipport { type inet_proto . inet_service : ipv4_addr . inet_service } chain prerouting { type nat hook prerouting priority dstnat + 1; policy accept; fib daddr type local dnat ip addr . port to meta l4proto . th dport map @map_port_ipport } chain output { type nat hook output priority -99; policy accept; ip daddr != 127.0.0.0/8 oif "lo" dnat ip addr . port to meta l4proto . th dport map @map_port_ipport } chain postrouting { type nat hook postrouting priority srcnat + 1; policy accept; ip saddr @masq_saddr masquerade } } table ip6 io.systemd.nat { chain input { type filter hook input priority filter; policy accept; iifname "lo" accept ct state invalid drop ct state { established, related } accept # ip6 protocol icmpv6 accept # ip6 protocol icmp accept meta l4proto ipv6-icmp accept tcp dport { 22, 2200, 2221, 2200, 25565 } accept udp dport { 546, 53, 67 } accept comment "allow dhcpv6-client, dns, and dhcp" udp dport { 60000-60009 } accept comment "allow mosh common ports" drop } chain forward { type filter hook forward priority filter; policy accept; accept } chain output { type filter hook output priority filter; policy accept; accept } }