#!/usr/sbin/nft -f

define tcp_ports = { {{ tcp_ports.strip().split(' ') | join(', ') }} }
{% if udp_ports.strip() %}
define udp_ports = { {{ udp_ports.strip().split(' ') | join(', ') }} }
{% endif %}

table inet filter {
    chain input {
        policy drop;
        ct state related,established counter accept;

        tcp dport $tcp_ports counter accept;
        {% if udp_ports.strip() %}
        udp dport $udp_ports counter accept;
        {% endif %}

        udp sport 1900 udp dport >= 1024 ip6 saddr { fd00::/8, fe80::/10 } meta pkttype unicast limit rate 4/second burst 20 packets accept comment "Accept UPnP IGD port mapping reply"
        udp sport 1900 udp dport >= 1024 ip saddr { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 } meta pkttype unicast limit rate 4/second burst 20 packets accept comment "Accept UPnP IGD port mapping reply"

        iifname "lo" counter accept;
        ip protocol icmp counter accept;
        ip6 nexthdr icmpv6 counter accept;
    }
}