split out input chain for loopback

nftables-attestation.conf

@@ -49,10 +49,7 @@ table inet filter {
         type filter hook input priority filter
         policy drop
 
-        iif lo tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset
+        iif lo goto input-internal
-        iif lo tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset
-
-        iif lo accept
         tcp dport { 80, 443 } accept
         meta l4proto { icmp, ipv6-icmp } accept
         ct state vmap { established : accept, related : accept, new : goto graceful-reject }
@@ -62,6 +59,12 @@ table inet filter {
         tcp dport 22 synproxy mss 1460 wscale 7 timestamp sack-perm
     }
 
+    chain input-internal {
+        tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset
+        tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset
+        accept
+    }
+
     chain forward {
         type filter hook forward priority filter
         policy drop

nftables-discuss.conf

@@ -52,10 +52,7 @@ table inet filter {
         type filter hook input priority filter
         policy drop
 
-        iif lo tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset
+        iif lo goto input-internal
-        iif lo tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset
-
-        iif lo accept
         tcp dport { 80, 443 } accept
         meta l4proto { icmp, ipv6-icmp } accept
         ct state vmap { established : accept, related : accept, new : goto graceful-reject }
@@ -65,6 +62,12 @@ table inet filter {
         tcp dport 22 synproxy mss 1460 wscale 7 timestamp sack-perm
     }
 
+    chain input-internal {
+        tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset
+        tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset
+        accept
+    }
+
     chain forward {
         type filter hook forward priority filter
         policy drop

nftables-mail.conf

@@ -49,10 +49,7 @@ table inet filter {
         type filter hook input priority filter
         policy drop
 
-        iif lo tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset
+        iif lo goto input-internal
-        iif lo tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset
-
-        iif lo accept
         tcp dport { 25, 80, 443, 465, 993 } accept
         meta l4proto { icmp, ipv6-icmp } accept
         ct state vmap { established : accept, related : accept, new : goto graceful-reject }
@@ -62,6 +59,12 @@ table inet filter {
         tcp dport 22 synproxy mss 1460 wscale 7 timestamp sack-perm
     }
 
+    chain input-internal {
+        tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset
+        tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset
+        accept
+    }
+
     chain forward {
         type filter hook forward priority filter
         policy drop

nftables-matrix.conf

@@ -49,10 +49,7 @@ table inet filter {
         type filter hook input priority filter
         policy drop
 
-        iif lo tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset
+        iif lo goto input-internal
-        iif lo tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset
-
-        iif lo accept
         tcp dport { 80, 443 } accept
         meta l4proto { icmp, ipv6-icmp } accept
         ct state vmap { established : accept, related : accept, new : goto graceful-reject }
@@ -62,6 +59,12 @@ table inet filter {
         tcp dport 22 synproxy mss 1460 wscale 7 timestamp sack-perm
     }
 
+    chain input-internal {
+        tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset
+        tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset
+        accept
+    }
+
     chain forward {
         type filter hook forward priority filter
         policy drop

nftables-network.conf

@@ -53,10 +53,7 @@ table inet filter {
         type filter hook input priority filter
         policy drop
 
-        iif lo tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset
+        iif lo goto input-internal
-        iif lo tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset
-
-        iif lo accept
         tcp dport { 80, 443, 7275 } accept
         udp dport 123 accept
         meta l4proto { icmp, ipv6-icmp } accept
@@ -67,6 +64,12 @@ table inet filter {
         tcp dport 22 synproxy mss 1460 wscale 7 timestamp sack-perm
     }
 
+    chain input-internal {
+        tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset
+        tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset
+        accept
+    }
+
     chain forward {
         type filter hook forward priority filter
         policy drop

nftables-ns1.conf

@@ -61,12 +61,7 @@ table inet filter {
         type filter hook input priority filter
         policy drop
 
-        iif lo tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset
+        iif lo goto input-internal
-        iif lo tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset
-        iif lo tcp dport { 53, 853 } tcp flags syn add @ip-connlimit-dns { ip saddr ct count over 16 } reject with tcp reset
-        iif lo tcp dport { 53, 853 } tcp flags syn add @ip6-connlimit-dns { ip6 saddr and ffff:ffff:ffff:ffff:: ct count over 16 } reject with tcp reset
-
-        iif lo accept
         udp dport 53 accept
         tcp dport { 80, 443 } accept
         meta l4proto { icmp, ipv6-icmp } accept
@@ -80,6 +75,14 @@ table inet filter {
         tcp dport { 53, 853 } synproxy mss 1460 wscale 7 timestamp sack-perm
     }
 
+    chain input-internal {
+        tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset
+        tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset
+        tcp dport { 53, 853 } tcp flags syn add @ip-connlimit-dns { ip saddr ct count over 16 } reject with tcp reset
+        tcp dport { 53, 853 } tcp flags syn add @ip6-connlimit-dns { ip6 saddr and ffff:ffff:ffff:ffff:: ct count over 16 } reject with tcp reset
+        accept
+    }
+
     chain forward {
         type filter hook forward priority filter
         policy drop

nftables-ns2.conf

@@ -66,12 +66,7 @@ table inet filter {
         type filter hook input priority filter
         policy drop
 
-        iif lo tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset
+        iif lo goto input-internal
-        iif lo tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset
-        iif lo tcp dport { 53, 853 } tcp flags syn add @ip-connlimit-dns { ip saddr ct count over 16 } reject with tcp reset
-        iif lo tcp dport { 53, 853 } tcp flags syn add @ip6-connlimit-dns { ip6 saddr and ffff:ffff:ffff:ffff:: ct count over 16 } reject with tcp reset
-
-        iif lo accept
         udp dport 53 accept
         tcp dport { 80, 443 } accept
         meta l4proto { icmp, ipv6-icmp } accept
@@ -85,6 +80,14 @@ table inet filter {
         tcp dport { 53, 853 } synproxy mss 1460 wscale 7 timestamp sack-perm
     }
 
+    chain input-internal {
+        tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset
+        tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset
+        tcp dport { 53, 853 } tcp flags syn add @ip-connlimit-dns { ip saddr ct count over 16 } reject with tcp reset
+        tcp dport { 53, 853 } tcp flags syn add @ip6-connlimit-dns { ip6 saddr and ffff:ffff:ffff:ffff:: ct count over 16 } reject with tcp reset
+        accept
+    }
+
     chain forward {
         type filter hook forward priority filter
         policy drop

nftables-social.conf

@@ -49,10 +49,7 @@ table inet filter {
         type filter hook input priority filter
         policy drop
 
-        iif lo tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset
+        iif lo goto input-internal
-        iif lo tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset
-
-        iif lo accept
         tcp dport { 80, 443 } accept
         meta l4proto { icmp, ipv6-icmp } accept
         ct state vmap { established : accept, related : accept, new : goto graceful-reject }
@@ -62,6 +59,12 @@ table inet filter {
         tcp dport 22 synproxy mss 1460 wscale 7 timestamp sack-perm
     }
 
+    chain input-internal {
+        tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset
+        tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset
+        accept
+    }
+
     chain forward {
         type filter hook forward priority filter
         policy drop

nftables-web.conf

@@ -53,10 +53,7 @@ table inet filter {
         type filter hook input priority filter
         policy drop
 
-        iif lo tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset
+        iif lo goto input-internal
-        iif lo tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset
-
-        iif lo accept
         tcp dport { 80, 443 } accept
         meta l4proto { icmp, ipv6-icmp } accept
         ct state vmap { established : accept, related : accept, new : goto graceful-reject }
@@ -66,6 +63,12 @@ table inet filter {
         tcp dport 22 synproxy mss 1460 wscale 7 timestamp sack-perm
     }
 
+    chain input-internal {
+        tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset
+        tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset
+        accept
+    }
+
     chain forward {
         type filter hook forward priority filter
         policy drop