spidark queries nftables

I had some kernel config issues re nftables. While helping me, spidark says

I have no idea (yet) what im doing.
But this works ( crippled i think but it works)
Can't remember where i got it from :( Sorry original author, and thanks )
However it does timeout my eix-sync and dhclient complains about ipv6 not permitted because of the drop state ( working on that )
Maybe you can figure it out.

#==== TO LIST sudo nft list ruleset
#==== TO DISCRIBE PORTS do sudo nft describe tcp dport

flush ruleset

table inet filter {
 set tcp_accepted {
  type inet_service; flags interval;
  elements = {
   http, https,rsync,
  }
 }
 set udp_accepted {
  type inet_service; flags interval;
  elements = {
   domain,
  }
 }

 chain base_checks {
  # allow established/related connections
  ct state {established, related} accept

  # early drop of invalid connections
  ct state invalid log prefix "Invalid Input Connection: " drop
 }
 chain input {
  type filter hook input priority 0; policy drop;

  jump base_checks

  # allow from loopback
  iifname lo accept

  # allow icmp
  ip protocol icmp icmp type { echo-request, echo-reply, time-exceeded, parameter-problem, destination-unreachable } accept
  ip6 nexthdr icmpv6 icmpv6 type { echo-request, echo-reply, time-exceeded, parameter-problem, destination-unreachable, packet-too-big, nd-router-advert, nd-router-solicit, nd-neighbor-solicit, nd-neighbor-advert, mld-listener-query } accept

  # allow ports
  #tcp dport @tcp_accepted accept
  #udp dport @udp_accepted accept

  # everything else
  reject with icmpx type port-unreachable
 }
 chain forward {
  type filter hook forward priority 0; policy drop;
  log prefix "Dropped Forward Connection: "
 }

 chain output {
  type filter hook output priority 0; policy drop;
  jump base_checks
  # allow ports
  tcp dport @tcp_accepted accept
  udp dport @udp_accepted accept
  #log prefix "Invalid Output Connection: " Warning : This floods logs
 }
}

I thought I could try help spidark. This is how I incrementally tried to resolve this.

As a first step, before I try fix anything, I simply rewrite these rules so I can understand them better.

I want to read compact clean code. So remove spurious lines.

flush ruleset
table inet filter {
 set tcp_accepted {
  type inet_service; flags interval;
  elements = {
   http, https,rsync,
  }
 }
 set udp_accepted {
  type inet_service; flags interval;
  elements = {
   domain,
  }
 }
 chain base_checks {
  ct state {established, related} accept
  ct state invalid log prefix "Invalid Input Connection: " drop
 }
 chain input {
  type filter hook input priority 0; policy drop;
  jump base_checks
  iifname lo accept
  ip protocol icmp icmp type { echo-request, echo-reply, time-exceeded, parameter-problem, destination-unreachable } accept
  ip6 nexthdr icmpv6 icmpv6 type { echo-request, echo-reply, time-exceeded, parameter-problem, destination-unreachable, packet-too-big, nd-router-advert, nd-router-solicit, nd-neighbor-solicit, nd-neighbor-advert, mld-listener-query } accept
  reject with icmpx type port-unreachable
 }
 chain forward {
  type filter hook forward priority 0; policy drop;
  log prefix "Dropped Forward Connection: "
 }
 chain output {
  type filter hook output priority 0; policy drop;
  jump base_checks
  tcp dport @tcp_accepted accept
  udp dport @udp_accepted accept
 }
}

I remove the chains base_checks, and move those rules as-in where they were called.

flush ruleset
table inet filter {
 set tcp_accepted {
  type inet_service; flags interval;
  elements = {
   http, https,rsync,
  }
 }
 set udp_accepted {
  type inet_service; flags interval;
  elements = {
   domain,
  }
 }
 chain input {
  type filter hook input priority 0; policy drop;
  ct state {established, related} accept
  ct state invalid log prefix "Invalid Input Connection: " drop
  iifname lo accept
  ip protocol icmp icmp type { echo-request, echo-reply, time-exceeded, parameter-problem, destination-unreachable } accept
  ip6 nexthdr icmpv6 icmpv6 type { echo-request, echo-reply, time-exceeded, parameter-problem, destination-unreachable, packet-too-big, nd-router-advert, nd-router-solicit, nd-neighbor-solicit, nd-neighbor-advert, mld-listener-query } accept
  reject with icmpx type port-unreachable
 }
 chain forward {
  type filter hook forward priority 0; policy drop;
  log prefix "Dropped Forward Connection: "
 }
 chain output {
  type filter hook output priority 0; policy drop;
  ct state {established, related} accept
  ct state invalid log prefix "Invalid Input Connection: " drop
  tcp dport @tcp_accepted accept
  udp dport @udp_accepted accept
 }
}

This shows us that sets - tcp_accepted and udp_accepted - are probably unnecessary as they are only used the one time. Sets are more useful, if we use them repeatedly many times.

So, I move those sets inline too.

flush ruleset
table inet filter {
 chain input {
  type filter hook input priority 0; policy drop;
  ct state {established, related} accept
  ct state invalid log prefix "Invalid Input Connection: " drop
  iifname lo accept
  ip protocol icmp icmp type { echo-request, echo-reply, time-exceeded, parameter-problem, destination-unreachable } accept
  ip6 nexthdr icmpv6 icmpv6 type { echo-request, echo-reply, time-exceeded, parameter-problem, destination-unreachable, packet-too-big, nd-router-advert, nd-router-solicit, nd-neighbor-solicit, nd-neighbor-advert, mld-listener-query } accept
  reject with icmpx type port-unreachable
 }
 chain forward {
  type filter hook forward priority 0; policy drop;
  log prefix "Dropped Forward Connection: "
 }
 chain output {
  type filter hook output priority 0; policy drop;
  ct state {established, related} accept
  ct state invalid log prefix "Invalid Input Connection: " drop
  tcp dport {http,https,rsync} accept
  udp dport {domain} accept
 }
}

Nothing has changed yet. The ruleset is still the same.

Now I can start modifying the ruleset, as all the logic is inline and not jumping about. Once we have a clean working rulset, we can create additional chains, sets, etc. where necessary to reduce the ruleset further.

Is this easier to understand the logic flow and/or troubleshoot?

---

[1] Explaining My Configs: nftables