#!/usr/bin/nft -f
#
# Restricted nftables configuration:
#   - Limit inbound traffic
#   - Allow outbound traffic to VPN's socks5 proxy
#   - Allow outbound traffic from UID 'tor'
#


#
# Definitions
#

# VPN server
define vpn_ip = 123.456.789.123

# individual IPs to be unrestricted
define exceptions = { 192.168.0.0/24, 192.168.1.0/24 }

#
# Rules
#

# clear all rules
flush ruleset

table inet restricted {

    chain inbound {
	type filter hook input priority 0;

	    # allow established/related connections
	    ct state {established, related} accept

	    # allow localhost traffic
	    iifname lo accept

	    # echo requests (pings) 
	    ip protocol icmp icmp type echo-request ct state new accept

	    # reject everything else
	    counter reject with icmp type port-unreachable
    }

    chain outbound {
	type filter hook output priority 0;

	    # allow localhost traffic
	    oifname lo accept

	    # allow VPN and exceptions directly
	    oifname wlp2s0 ip daddr { $vpn_ip, $exceptions } accept

	    # allow all traffic from UID tor
	    oifname wlp2s0 skuid tor counter accept

	    # allow wireguard traffic but only if destined to proxy
	    oifname wg0 ip daddr { 10.64.0.1 } accept
	    #oifname wg0 accept

	    # reject remaining
	    counter reject
    }

    # no forwarding
    chain forward {
	type filter hook forward priority 0; policy drop;
    }
}