#!/usr/sbin/nft -f
#
# KF1 DDoS protection - nftables port of the RouterOS setup.
#
# Hook order in prerouting:
#   raw (-300)  -> conntrack (-200) -> mangle (-150) -> dstnat (-100)
# so kf1_raw drops before a conntrack entry exists, and `detect` sees
# conntrack state but still the public (pre-DNAT) destination,
# exactly like RouterOS raw / mangle prerouting.

define WAN_IFS  = { "eth0" }        # = interface-list WAN
define KF1_PUB  = 7707              # port clients connect to (pre-DNAT)
define KF1_SRV  = 192.168.88.10     # game server LAN address
define KF1_PORT = 7707              # port on the server (post-DNAT)

# Idempotent reload: create-if-missing, then wipe and redefine.
table ip kf1
delete table ip kf1

table ip kf1 {
	set active {                    # filled from the packet path
		type ipv4_addr
		flags dynamic, timeout
		timeout 60m
		size 65536
	}
	set ddos {                      # auto safety switch, keyed by public port
		type inet_service
		flags dynamic, timeout
		timeout 10m
		size 16
	}

	# = /ip firewall raw  (before conntrack: drops create no entries)
	chain raw_pre {
		type filter hook prerouting priority raw; policy accept;
		iifname $WAN_IFS udp dport $KF1_PUB jump kf1_raw
	}
	chain kf1_raw {
		ip saddr @active accept
		udp dport @ddos counter drop comment "KF1 auto safety switch"
	}

	# = mangle prerouting "KF1 DDoS auto-detect"
	chain detect {
		type filter hook prerouting priority mangle; policy accept;
		iifname $WAN_IFS udp dport $KF1_PUB ct state new ct count over 100 counter update @ddos { udp dport } comment "KF1 DDoS auto-detect"
	}

	# = /ip firewall nat dstnat (drop this if your DNAT lives elsewhere)
	chain dstnat {
		type nat hook prerouting priority dstnat; policy accept;
		iifname $WAN_IFS udp dport $KF1_PUB dnat to $KF1_SRV:$KF1_PORT
	}

	# = /ip firewall filter forward + kf1-new
	chain forward {
		type filter hook forward priority filter; policy accept;
		iifname $WAN_IFS ct status dnat ct state { established, new } udp dport $KF1_PORT jump kf1_new comment "Jump to kf1-new"
	}
	chain kf1_new {
		ct state established update @active { ip saddr } accept comment "Track + accept established KF1"
		ct count over 100 counter drop comment "Global connection limit to KF server"
	}
}