# gre-panel:managed=1
#
# The panel's port forwarding ruleset, rendered from the database. Every change
# rewrites this file in full and applies it with a single nft transaction, so the
# kernel never holds a partial ruleset.
#
# Everything the panel installs lives in the one table below. Replacing that table
# replaces the panel's rules and touches nothing else on this host: rules belonging
# to Docker, firewalld or anything else live in their own tables and are never read,
# flushed or reordered from here.
#
# Every rule carries the comment grep:<RouteRuleID>, which is what lets a rule read
# back from the kernel be matched to the database row that generated it.

# Declaring the table before flushing it makes this file work on a host that has
# never seen it; flushing a table that does not exist is an error.
table inet gre_panel
flush table inet gre_panel

table inet gre_panel {
	# Named counter objects, one pair per rule. Byte accounting reads these,
	# never the nat chains: a nat hook only ever sees the first packet of a
	# connection, so counting there would report connections as if they were
	# bytes and under-report traffic by orders of magnitude.
	counter route_3_rx {
	}
	counter route_3_tx {
	}
	counter route_7_rx {
	}
	counter route_7_tx {
	}
	counter route_9_rx {
	}
	counter route_9_tx {
	}

	chain prerouting {
		type nat hook prerouting priority dstnat; policy accept;
		# Destination NAT: traffic arriving for a rule is redirected to its destination.
		# route 3 "First": udp 203.0.113.10:51820 -> 172.31.7.2:51820 [nat masquerade]
		ip daddr 203.0.113.10 udp dport 51820 dnat ip to 172.31.7.2:51820 comment "grep:3"
		# route 7 "Second": tcp 203.0.113.10:8443 -> 172.31.7.2:443 [nat none]
		ip daddr 203.0.113.10 tcp dport 8443 dnat ip to 172.31.7.2:443 comment "grep:7"
		# route 9 "IPv6 as well": tcp 2001:db8::10:993 -> 2001:db8:1::20:993 [nat masquerade]
		ip6 daddr 2001:db8::10 tcp dport 993 dnat ip6 to [2001:db8:1::20]:993 comment "grep:9"
	}
	chain postrouting {
		type nat hook postrouting priority srcnat; policy accept;
		# Source NAT. Absent for a rule whose NAT mode is None, which preserves the
		# client address and needs the return path to come back through this server.
		# route 3 "First": udp 203.0.113.10:51820 -> 172.31.7.2:51820 [nat masquerade]
		ip daddr 172.31.7.2 udp dport 51820 masquerade comment "grep:3"
		# route 9 "IPv6 as well": tcp 2001:db8::10:993 -> 2001:db8:1::20:993 [nat masquerade]
		ip6 daddr 2001:db8:1::20 tcp dport 993 masquerade comment "grep:9"
	}
	chain forward {
		type filter hook forward priority filter; policy accept;
		# Forward permission. The established/related rule covers the return direction,
		# so no reverse rule matching on source port is emitted: conntrack expresses the
		# intent exactly, and matching on the far end's source port would accept traffic
		# that belongs to no flow this server ever started.
		ct state established,related accept comment "gre-panel:structural"
		# route 3 "First": udp 203.0.113.10:51820 -> 172.31.7.2:51820 [nat masquerade]
		ip daddr 172.31.7.2 udp dport 51820 accept comment "grep:3"
		# route 7 "Second": tcp 203.0.113.10:8443 -> 172.31.7.2:443 [nat none]
		ip daddr 172.31.7.2 tcp dport 443 accept comment "grep:7"
		# route 9 "IPv6 as well": tcp 2001:db8::10:993 -> 2001:db8:1::20:993 [nat masquerade]
		ip6 daddr 2001:db8:1::20 tcp dport 993 accept comment "grep:9"
	}
	chain accounting {
		type filter hook forward priority filter - 10; policy accept;
		# Accounting. These rules carry no verdict, so they count and fall through
		# without influencing policy, and they sit at their own priority so they see
		# traffic whatever the forward chain decides.
		# route 3 "First": udp 203.0.113.10:51820 -> 172.31.7.2:51820 [nat masquerade]
		ip daddr 172.31.7.2 udp dport 51820 counter name "route_3_tx" comment "grep:3"
		ip saddr 172.31.7.2 udp sport 51820 counter name "route_3_rx" comment "grep:3"
		# route 7 "Second": tcp 203.0.113.10:8443 -> 172.31.7.2:443 [nat none]
		ip daddr 172.31.7.2 tcp dport 443 counter name "route_7_tx" comment "grep:7"
		ip saddr 172.31.7.2 tcp sport 443 counter name "route_7_rx" comment "grep:7"
		# route 9 "IPv6 as well": tcp 2001:db8::10:993 -> 2001:db8:1::20:993 [nat masquerade]
		ip6 daddr 2001:db8:1::20 tcp dport 993 counter name "route_9_tx" comment "grep:9"
		ip6 saddr 2001:db8:1::20 tcp sport 993 counter name "route_9_rx" comment "grep:9"
	}
	chain mss_clamp {
		type filter hook forward priority mangle; policy accept;
		# MSS clamping. A relay whose destination is reached across a tunnel hands the
		# client an MSS the path cannot carry; connections then establish and stall on
		# the first large transfer. The mask form matches a SYN without RST, so a
		# reset is not rewritten.
		# route 7 "Second": tcp 203.0.113.10:8443 -> 172.31.7.2:443 [nat none]
		ip daddr 172.31.7.2 tcp dport 443 tcp flags syn / syn,rst tcp option maxseg size set rt mtu comment "grep:7"
	}
}