nftables

nftables.conf

#!/usr/sbin/nft -f

flush ruleset

table inet filter {
    # Define allowed IP range
    set allowed_nets {
        type ipv4_addr
        flags interval
        elements = {
            192.168.50.0/24,    # home network
            # libbyapp.com
            13.33.28.101, 13.33.28.119, 13.33.28.104, 13.33.28.68,
            204.93.150.152, 204.93.150.153, 52.55.44.173, 207.54.136.33, 207.54.137.22,
            52.188.143.188, 52.201.205.139, 34.196.50.219, 13.224.103.0/24,
            # tldraw.com
            104.18.12.31, 104.18.13.31
        }
    }

    chain input {
        type filter hook input priority 0;
        
        # Default drop policy
        policy drop;
        
        # Accept loopback
        iif lo accept
        
        # Accept established connections
        ct state established,related accept
        
        # Accept all traffic from LAN
        ip saddr @allowed_nets accept
        
        # Accept SSH (port 22)
        tcp dport 22 accept
        
	# Accept Localsend App
	tcp dport 53317 accept
	udp dport 53317 accept
    }
    
    chain output {
        type filter hook output priority 0;
        
        # Default drop policy
        policy drop;
        
        # Accept loopback
        oif lo accept
        
        # Accept established connections
        ct state established,related accept
        
        # Accept all traffic to LAN
        ip daddr @allowed_nets accept
        
        # Accept SSH responses
        tcp sport 22 accept
        
	# Accept Localsend App
	tcp sport 53317 accept
	udp sport 53317 accept
        
        # DNS servers
        ip daddr { 8.8.8.8, 8.8.4.4, 1.1.1.1, 208.67.222.123, 208.67.220.123 } accept    # Common DNS servers
    }
    
    chain forward {
        type filter hook forward priority 0;
        policy drop;
    }
}

setup_firewall.sh

#!/bin/bash

# Configuration file path
NFTABLES_CONF="/etc/nftables.conf"

# Configuration - Add domains here
DOMAINS=(
    #"libbyapp.com"
    #"read.libbyapp.com"
    #"sentry.libbyapp.com"
    #"vandal.libbyapp.com"
    #"ic.od-cdn.com"
    #"img1.od-cdn.com"
    #"thunder.api.overdrive.com"
    #"ntc.api.overdrive.com"
    #"tldraw.com"
    #"ezhishi.com"
)

# Static networks and IPs
STATIC_NETS=(
    "192.168.50.0/24"    # home network
)

# Function to resolve domain and return all unique IPs
get_domain_ips() {
    local domain=$1
    # skip domain if it starts with #
    [[ $domain == \#* ]] && return

    # Using dig instead of nslookup for more reliable parsing
    # Get both A and AAAA records, extract IPs, and remove duplicates
    dig +short "$domain" | sort -u | grep -E '^[0-9]+\.'
}

# Start generating the configuration
cat << 'EOF' > "${NFTABLES_CONF}"
#!/usr/sbin/nft -f
flush ruleset
table inet filter {
    # Define allowed IP range
    set allowed_nets {
        type ipv4_addr
        flags interval
        elements = {
EOF

# Add static networks
for net in "${STATIC_NETS[@]}"; do
    echo "            $net," >> "${NFTABLES_CONF}"
done

# Resolve each domain and add IPs
for domain in "${DOMAINS[@]}"; do
    echo "            # $domain" >> "${NFTABLES_CONF}"
    IPS=$(get_domain_ips "$domain")
    while IFS= read -r ip; do
        if [ ! -z "$ip" ]; then
            echo "            $ip," >> "${NFTABLES_CONF}"
        fi
    done <<< "$IPS"
done

# Add DNS servers and complete the configuration
cat << 'EOF' >> "${NFTABLES_CONF}"
        }
    }
    chain input {
        type filter hook input priority 0;
        # Default drop policy
        policy drop;
        # Accept loopback
        iif lo accept
        # Accept established connections
        ct state established,related accept
        # Accept all traffic from LAN
        ip saddr @allowed_nets accept
        # Accept SSH (port 22)
        tcp dport 22 accept
        # Accept Localsend App
        tcp dport 53317 accept
        udp dport 53317 accept
    }
    chain output {
        type filter hook output priority 0;
        # Default drop policy
        policy drop;
        # Accept loopback
        oif lo accept
        # Accept established connections
        ct state established,related accept
        # Accept all traffic to LAN
        ip daddr @allowed_nets accept
        # Accept SSH responses
        tcp sport 22 accept
        # Accept Localsend App
        tcp sport 53317 accept
        udp sport 53317 accept
        # DNS servers
        ip daddr { 8.8.8.8, 8.8.4.4, 1.1.1.1, 208.67.222.123, 208.67.220.123 } accept    # Common DNS servers
    }
    chain forward {
        type filter hook forward priority 0;
        policy drop;
    }
}
EOF

# Set proper permissions
chmod 644 /etc/nftables.conf

# Optionally reload nftables (uncomment if needed)
nft -f /etc/nftables.conf

ping libbyapp.com -c 3