# A set containing the udp port(s) to which SSDP replies are allowed.
set ssdp_out {
  type inet_service
  timeout 5s
}
set lograte4 { type ipv4_addr; size 65535; flags dynamic; }
set lograte6 { type ipv6_addr; size 65535; flags dynamic; }
chain block {
  add @lograte4 { ip  saddr limit rate 1/minute } log level warn prefix "block: "
  add @lograte6 { ip6 saddr limit rate 1/minute } log level warn prefix "block: "
  counter drop
}
chain ping-flood {
  add @lograte4 { ip  saddr limit rate 1/minute } log level warn prefix "ping-flood: "
  add @lograte6 { ip6 saddr limit rate 1/minute } log level warn prefix "ping-flood: "
  counter drop
}
chain smurf {
  add @lograte4 { ip  saddr limit rate 1/minute } log level warn prefix "smurf: "
  add @lograte6 { ip6 saddr limit rate 1/minute } log level warn prefix "smurf: "
  counter drop
}
chain bogus-tcp {
  add @lograte4 { ip  saddr limit rate 1/minute } log level warn prefix "bogus-tcp: "
  add @lograte6 { ip6 saddr limit rate 1/minute } log level warn prefix "bogus-tcp: "
  counter drop
}
chain syn-flood {
  add @lograte4 { ip  saddr limit rate 1/minute } log level warn prefix "syn-flood: "
  add @lograte6 { ip6 saddr limit rate 1/minute } log level warn prefix "syn-flood: "
  counter drop
}
chain check-tcp {
  tcp flags syn tcp option maxseg size != 536-65535 counter goto bogus-tcp
  tcp flags & (ack|fin) == fin counter goto bogus-tcp
  tcp flags & (ack|psh) == psh counter goto bogus-tcp
  tcp flags & (ack|urg) == urg counter goto bogus-tcp
  tcp flags & (fin|ack) == fin counter goto bogus-tcp
  tcp flags & (fin|rst) == (fin|rst) counter goto bogus-tcp
  tcp flags & (fin|psh|ack) == (fin|psh) counter goto bogus-tcp
  tcp flags & (syn|fin) == (syn|fin) counter goto bogus-tcp comment "SYN-FIN scan"
  tcp flags & (syn|rst) == (syn|rst) counter goto bogus-tcp comment "SYN-RST scan"
  tcp flags == (fin|syn|rst|psh|ack|urg) counter goto bogus-tcp comment "XMAS scan"
  tcp flags == 0x0 counter goto bogus-tcp comment "NULL scan"
  tcp flags == (fin|urg|psh) counter goto bogus-tcp
  tcp flags == (fin|urg|psh|syn) counter goto bogus-tcp comment "NMAP-ID"
  tcp flags == (fin|urg|syn|rst|ack) counter goto bogus-tcp

  ct state new tcp flags != syn counter goto bogus-tcp
  tcp sport 0 tcp flags & (fin|syn|rst|ack) == syn counter goto bogus-tcp
  tcp flags & (fin|syn|rst|ack) == syn counter limit rate over 30/second burst 60 packets goto syn-flood
}
chain spoofing {
  add @lograte4 { ip  saddr limit rate 1/minute } log level warn prefix "spoofing: "
  counter drop
}
chain check-broadcast {
  #ip saddr 0.0.0.0/32 counter accept comment "DHCP broadcast"
  fib saddr type broadcast counter goto smurf
  #ip saddr 224.0.0.0/4     counter goto smurf
}
chain check-ping {
  ip protocol icmp icmp type echo-request limit rate over 10/second burst 20 packets goto ping-flood
  ip6 nexthdr ipv6-icmp icmpv6 type echo-request limit rate over 10/second burst 20 packets goto ping-flood
}
chain check-public {
  ip saddr 0.0.0.0/8 counter goto spoofing
  ip saddr 10.0.0.0/8 counter goto spoofing
  ip saddr 127.0.0.0/8 counter goto spoofing
  ip saddr 169.254.0.0/16 counter goto spoofing
  ip saddr 172.16.0.0/12 counter goto spoofing
  ip saddr 192.0.2.0/24 counter goto spoofing
  ip saddr 192.168.0.0/16 counter goto spoofing
  ip saddr 224.0.0.0/3 counter goto spoofing
  ip saddr 240.0.0.0/5 counter goto spoofing
}
chain accept-icmpv6 {
  # Traffic That Must Not Be Dropped
  # https://tools.ietf.org/html/rfc4890#section-4.4.1
  icmpv6 type destination-unreachable counter accept
  icmpv6 type packet-too-big counter accept
  icmpv6 type time-exceeded counter accept
  icmpv6 type parameter-problem counter accept

  # Address Configuration and Router Selection messages
  # (must be received with hop limit = 255)
  icmpv6 type nd-router-solicit ip6 hoplimit 255 counter accept
  ip6 nexthdr ipv6-icmp icmpv6 type nd-router-advert ip6 hoplimit 255 counter accept
  icmpv6 type nd-neighbor-solicit ip6 hoplimit 255 counter accept
  icmpv6 type nd-neighbor-advert ip6 hoplimit 255 counter accept
  icmpv6 type nd-redirect ip6 hoplimit 255 log level warn prefix "icmpv6: nd-redirect: " counter drop
  icmpv6 type ind-neighbor-solicit ip6 hoplimit 255 counter accept
  icmpv6 type ind-neighbor-advert ip6 hoplimit 255 counter accept

  # Link-local multicast receiver notification messages
  # (must have link-local source address)
  icmpv6 type mld-listener-query ip6 saddr fe80::/10 counter accept
  icmpv6 type mld-listener-report ip6 saddr fe80::/10 counter accept
  icmpv6 type mld-listener-done ip6 saddr fe80::/10 counter accept
  # https://tools.ietf.org/html/rfc3810 Multicast Listener Discovery Version 2 (MLDv2) for IPv6
  icmpv6 type mld2-listener-report ip6 saddr fe80::/10 counter accept

  # SEND Certificate Path notification messages
  # (must be received with hop limit = 255)
  icmpv6 type 148 ip6 hoplimit 255 counter accept comment "certificate-path-solicitation"
  icmpv6 type 149 ip6 hoplimit 255 counter accept comment "certificate-path-advertisement"

  # Multicast Router Discovery messages
  # (must have link-local source address and hop limit = 1)
  icmpv6 type 151 ip6 saddr fe80::/10 ip6 hoplimit 1 counter accept comment "multicast-router-advertisement"
  icmpv6 type 152 ip6 saddr fe80::/10 ip6 hoplimit 1 counter accept comment "multicast-router-solicitation"
  icmpv6 type 153 ip6 saddr fe80::/10 ip6 hoplimit 1 counter accept comment "multicast-router-termination"
}
chain accept-connectivity-input {
  # Connectivity checking messages
  # (multicast) ping
  ip protocol icmp icmp type echo-reply counter accept

  # drop packets with rh0 headers
  rt type 0 jump block
  rt type 0 jump block
  rt type 0 jump block

  # (multicast) ping
  ip6 nexthdr ipv6-icmp icmpv6 type echo-reply counter accept
  #ct state invalid counter drop

  ip protocol icmp icmp type destination-unreachable counter accept
  ip protocol icmp icmp type time-exceeded counter accept
  ip protocol icmp icmp type parameter-problem counter accept
  ip protocol icmp icmp type echo-request limit rate over 10/second burst 20 packets goto ping-flood
  ip protocol icmp icmp type echo-request counter accept
  # echo-reply is handled before invalid packets to allow multicast ping
  # which do not have an associated connection.

  ip6 nexthdr ipv6-icmp jump accept-icmpv6

  # Connectivity checking messages
  icmpv6 type echo-request counter accept
  # echo-reply is handled before invalid because of multicast
}
chain accept-connectivity-output {
  ip protocol icmp counter accept
  meta skuid 0 udp dport 33434-33523 counter accept comment "traceroute"

  ip6 nexthdr ipv6-icmp jump accept-icmpv6

  # Connectivity checking messages
  ip6 nexthdr ipv6-icmp icmpv6 type echo-request counter accept
  ip6 nexthdr ipv6-icmp icmpv6 type echo-reply counter accept
}
chain accept-connectivity-forward {
  ip protocol icmp icmp type destination-unreachable counter accept
  ip protocol icmp icmp type time-exceeded counter accept
  ip protocol icmp icmp type parameter-problem counter accept
  ip protocol icmp icmp type echo-request counter accept

  # Traffic That Must Not Be Dropped
  # https://tools.ietf.org/html/rfc4890#section-4.3.1
  ip6 nexthdr ipv6-icmp icmpv6 type destination-unreachable counter accept
  ip6 nexthdr ipv6-icmp icmpv6 type packet-too-big counter accept
  ip6 nexthdr ipv6-icmp icmpv6 type time-exceeded counter accept
  ip6 nexthdr ipv6-icmp icmpv6 type parameter-problem counter accept

  # Connectivity checking messages
  ip6 nexthdr ipv6-icmp icmpv6 type echo-request counter accept
  ip6 nexthdr ipv6-icmp icmpv6 type echo-reply counter accept

  # Traffic That Normally Should Not Be Dropped
  # https://tools.ietf.org/html/rfc4890#section-4.3.2
  ip6 nexthdr ipv6-icmp icmpv6 type 144 counter accept comment "home-agent-address-discovery-request"
  ip6 nexthdr ipv6-icmp icmpv6 type 145 counter accept comment "home-agent-address-discovery-reply"
  ip6 nexthdr ipv6-icmp icmpv6 type 146 counter accept comment "mobile-prefix-solicitation"
  ip6 nexthdr ipv6-icmp icmpv6 type 147 counter accept comment "mobile-prefix-advertisement"
}