# tomswall configuration
# Spiritual successor to shorewall — manages nftables directly

settings:
  ip_forwarding: true
  log_level: info
  table_name: tomswall

# Named port groups — reusable port+protocol combos referenced in rules
portgroups:
  web:
    proto: tcp
    ports: [80, 443]
  dns_udp:
    proto: udp
    ports: [53]
  dns_tcp:
    proto: tcp
    ports: [53]
  ssh:
    proto: tcp
    ports: [22]
  mail:
    proto: tcp
    ports: [25, 465, 587, 993, 995]
  high_ports:
    proto: tcp
    ports: ["1024-65535"]

# Security zones (replaces /etc/shorewall/zones)
zones:
  fw:
    type: firewall
  net:
    type: ip
  loc:
    type: ip
  dmz:
    type: ip

# Interface-to-zone mappings (replaces /etc/shorewall/interfaces)
interfaces:
  - zone: net
    interface: eth0
    options:
      dhcp: true
      tcpflags: true
      nosmurfs: true
  - zone: loc
    interface: eth1
  - zone: dmz
    interface: eth2

# Host definitions (replaces /etc/shorewall/hosts)
hosts:
  - zone: loc
    interface: eth1
    addresses:
      - 192.168.1.0/24

# Default zone-to-zone policies (replaces /etc/shorewall/policy)
# Evaluated in order after specific rules; first match wins
policy:
  - source: fw
    dest: all
    action: accept
  - source: loc
    dest: net
    action: accept
  - source: loc
    dest: fw
    action: accept
  - source: net
    dest: all
    action: drop
    log: info
  - source: all
    dest: all
    action: reject
    log: info

# Specific traffic rules (replaces /etc/shorewall/rules)
# Supports zone:address notation, e.g. source: "net:203.0.113.0/24"
rules:
  # Allow SSH from local network to firewall
  - action: accept
    source: loc
    dest: fw
    portgroup: ssh

  # Allow DNS from local network
  - action: accept
    source: loc
    dest: net
    portgroup: dns_udp
  - action: accept
    source: loc
    dest: net
    portgroup: dns_tcp

  # Allow web traffic from net to DMZ
  - action: accept
    source: net
    dest: dmz
    portgroup: web

  # Allow ping from local network
  - action: accept
    source: loc
    dest: fw
    proto: icmp

  # Drop all other ICMP from net
  - action: drop
    source: net
    dest: all
    proto: icmp

# Source NAT rules (replaces /etc/shorewall/snat)
snat:
  - action: masquerade
    source: 192.168.1.0/24
    dest_interface: eth0