#!/usr/sbin/nft -f

#

# KF1 DDoS protection - nftables port of the RouterOS setup.

#

# Hook order in prerouting:

# raw (-300) -> conntrack (-200) -> mangle (-150) -> dstnat (-100)

# so kf1_raw drops before a conntrack entry exists, and `detect` sees

# conntrack state but still the public (pre-DNAT) destination,

# exactly like RouterOS raw / mangle prerouting.

 

define WAN_IFS = { "eth0" } # = interface-list WAN

define KF1_PUB = 7707 # port clients connect to (pre-DNAT)

define KF1_SRV = 192.168.88.10 # game server LAN address

define KF1_PORT = 7707 # port on the server (post-DNAT)

 

# Idempotent reload: create-if-missing, then wipe and redefine.

table ip kf1

delete table ip kf1

 

table ip kf1 {

set active { # filled from the packet path

type ipv4_addr

flags dynamic, timeout

timeout 60m

size 65536

}

set ddos { # auto safety switch, keyed by public port

type inet_service

flags dynamic, timeout

timeout 10m

size 16

}

 

# = /ip firewall raw (before conntrack: drops create no entries)

chain raw_pre {

type filter hook prerouting priority raw; policy accept;

iifname $WAN_IFS udp dport $KF1_PUB jump kf1_raw

}

chain kf1_raw {

ip saddr @active accept

udp dport @ddos counter drop comment "KF1 auto safety switch"

}

 

# = mangle prerouting "KF1 DDoS auto-detect"

chain detect {

type filter hook prerouting priority mangle; policy accept;

iifname $WAN_IFS udp dport $KF1_PUB ct state new ct count over 100 counter update @ddos { udp dport } comment "KF1 DDoS auto-detect"

}

 

# = /ip firewall nat dstnat (drop this if your DNAT lives elsewhere)

chain dstnat {

type nat hook prerouting priority dstnat; policy accept;

iifname $WAN_IFS udp dport $KF1_PUB dnat to $KF1_SRV:$KF1_PORT

}

 

# = /ip firewall filter forward + kf1-new

chain forward {

type filter hook forward priority filter; policy accept;

iifname $WAN_IFS ct status dnat ct state { established, new } udp dport $KF1_PORT jump kf1_new comment "Jump to kf1-new"

}

chain kf1_new {

ct state established update @active { ip saddr } accept comment "Track + accept established KF1"

ct count over 100 counter drop comment "Global connection limit to KF server"

}

}