#!/usr/sbin/nft -f
#
# KF1 DDoS protection - nftables port of the RouterOS setup.
#
# Hook order in prerouting:
# raw (-300) -> conntrack (-200) -> mangle (-150) -> dstnat (-100)
# so kf1_raw drops before a conntrack entry exists, and `detect` sees
# conntrack state but still the public (pre-DNAT) destination,
# exactly like RouterOS raw / mangle prerouting.

define WAN_IFS = { "eth0" } # = interface-list WAN
define KF1_PUB = 7707 # port clients connect to (pre-DNAT)
define KF1_SRV = 192.168.88.10 # game server LAN address
define KF1_PORT = 7707 # port on the server (post-DNAT)

# Idempotent reload: create-if-missing, then wipe and redefine.
table ip kf1
delete table ip kf1

table ip kf1 {
set active { # filled from the packet path
type ipv4_addr
flags dynamic, timeout
timeout 60m
size 65536
}
set ddos { # auto safety switch, keyed by public port
type inet_service
flags dynamic, timeout
timeout 10m
size 16
}

# = /ip firewall raw (before conntrack: drops create no entries)
chain raw_pre {
type filter hook prerouting priority raw; policy accept;
iifname $WAN_IFS udp dport $KF1_PUB jump kf1_raw
}
chain kf1_raw {
ip saddr @active accept
udp dport @ddos counter drop comment "KF1 auto safety switch"
}

# = mangle prerouting "KF1 DDoS auto-detect"
chain detect {
type filter hook prerouting priority mangle; policy accept;
iifname $WAN_IFS udp dport $KF1_PUB ct state new ct count over 100 counter update @ddos { udp dport } comment "KF1 DDoS auto-detect"
}

# = /ip firewall nat dstnat (drop this if your DNAT lives elsewhere)
chain dstnat {
type nat hook prerouting priority dstnat; policy accept;
iifname $WAN_IFS udp dport $KF1_PUB dnat to $KF1_SRV:$KF1_PORT
}

# = /ip firewall filter forward + kf1-new
chain forward {
type filter hook forward priority filter; policy accept;
iifname $WAN_IFS ct status dnat ct state { established, new } udp dport $KF1_PORT jump kf1_new comment "Jump to kf1-new"
}
chain kf1_new {
ct state established update @active { ip saddr } accept comment "Track + accept established KF1"
ct count over 100 counter drop comment "Global connection limit to KF server"
}
}