nftgen 1.0.0__tar.gz

nftgen-1.0.0/.gitignore

@@ -0,0 +1,15 @@
+__pycache__/
+*.py[cod]
+*.egg-info/
+.eggs/
+build/
+dist/
+.venv/
+venv/
+.pytest_cache/
+# generated rulesets are transient, EXCEPT the drift-pinned example projects
+# whose committed render is the golden their drift tests compare against.
+**/generated/
+!example-fleet/generated/
+# local Claude Code config (agents, settings) stays local
+.claude/

nftgen-1.0.0/CHANGELOG.md

@@ -0,0 +1,123 @@
+# Changelog
+
+What changed per release, newest first. Details are in the commit messages;
+the *why* behind design choices is in [DECISIONS.md](DECISIONS.md).
+
+Versioning: [semantic versioning](https://semver.org) from 1.0.0 on. A new
+check that rejects input which rendered a wrong or broken ruleset is a fix,
+not a breaking change.
+
+## 1.0.0 — 2026-10-18
+
+The first release on PyPI (`pip install nftgen`).
+
+### Breaking
+
+- Rule values are schema-checked: an `action:` word outside `accept`, `drop`,
+  `reject`, `return`, `continue`, `masquerade` or `reject with …` is an error
+  (use `raw:` for others).
+- Python 3.10 dropped; `requires-python >=3.11`.
+
+### New
+
+- `comment:` on rules, chains, set entries and tables — native nft comments.
+- One value or a list on every matching key (`dport: [ssh, 8080]`,
+  `saddr: [mgmt, 10.0.0.5]`); `ct: established` takes one state plain.
+- `proto:` is optional when the ports come from services: each port keeps
+  its own protocol (`meta l4proto . th dport { tcp . 53, udp . 53 }`).
+- Concat vmap rows take `action:` (accept, drop, return, continue, jump, goto).
+- `family: ip | ip6` for concat sets filled at runtime.
+- Protocol numbers (`17`, `112`) are checked as their names everywhere.
+- `render_tables(…, annotate=fn)`: an optional per-rule hook whose note is
+  appended as a `# <note>` file comment (used by ansible-firewall's blame
+  notes); output is unchanged without it.
+
+### Fixed
+
+Mistakes that rendered a wrong or broken ruleset now fail the
+build with a clear error:
+
+- `nftgen build <typo>` with no host policies; `--host` with a path or a
+  pattern; two files for one host (`fw1.yaml` + `fw1.yml`).
+- `type:`/`policy:`/`priority:` on a chain without `hook:`.
+- `iif`/`oif` with a named interface set; `flow-offload:` to an undeclared
+  flowtable; mark, `set-mss`, log level/group/prefix values.
+- Duplicate map keys; a `sport`+`dport` vmap without a `proto` column; a port
+  on a protocol without ports; reject/masquerade inside a vmap.
+- `icmp`/`icmpv6` with dual-stack addresses render only their own family.
+- `log:` with both `level` and `group` (nft refuses the pair).
+- Flowtable `devices:` takes one group plain (`devices: wan` was read letter
+  by letter); a device shared by two groups is listed once.
+- Hand-written sets: `flags:` must be nft set flags (`auto-merge` isn't one);
+  `flags:`/`elements:` take one value plain instead of letter by letter.
+- Table `counters:`/`raw:` take one value plain (`counters: bad` rendered
+  counters `b`, `a`, `d`); a blank `chains:` is empty instead of a crash;
+  wrong shapes (`chains:` as a mapping, a non-text name, `concat:` as a
+  string) are clean errors.
+- `log: {}` logs; OS errors are clean errors; a closed stdout pipe exits
+  quietly (141).
+
+### Infra
+
+Renovate (auto-merges minor updates after CI), weekly CI, a lint
+job plus tests on Python 3.11–3.14.
+
+## 0.7.0 — 2026-10-11
+
+**Breaking:** named service sets are `(proto . port)` pair sets
+(`type inet_proto . inet_service`); `dport`/`sport` vmaps are
+`meta l4proto . th dport` pair lookups, and a bare port number there needs
+`/tcp`.
+
+- A named service set or a port vmap no longer opens a port on a protocol the
+  service doesn't have (udp/80 for a tcp-only service) — proven on the wire.
+- Include files are validated: a typo'd section (`rule:`), a file under the
+  wrong list, or a non-list fragment is an error instead of contributing
+  nothing (an empty `policy: drop` chain = a lockout on deploy).
+
+## 0.6.0 — 2026-07-14
+
+- `render_tables()` core + `PathResolver` / `DictResolver`: nftgen can be
+  embedded as a render backend (sessrumnir's Ansible vars mode uses it).
+- `Definitions.from_named_mappings()`, with both origins named in duplicate
+  errors; malformed definition layers are clean errors.
+
+## 0.5.0 — 2026-07-13
+
+- `nftgen build <root> --host X --stdout`: render one host to stdout, write
+  nothing.
+
+## 0.4.0 — 2026-07-11
+
+**Breaking:** interface keys renamed `iif`/`oif` → `iifname`/`oifname`
+(matching nft); object names that are reserved nft keywords are an error.
+
+- `iif:`/`oif:` index matching; `meter:` per-key rate limiting.
+- `example-fleet/`: a realistic 3-site reference, replacing `example-poc/`.
+- Behavioral (network-namespace) tests: the B01–B26 primitive matrix and the
+  P01–P22 example-fleet matrix — which found that `flow-offload:` + `action:`
+  in one rule drops the handshake; that form is now an error.
+- CI on GitHub Actions: lint, tests incl. `nft -c` and netns, drift gate.
+
+## 0.3.0 — 2026-07-05
+
+- Large set/map literals render one element per line (one-line git diffs).
+- Bare `dnat:`/`snat:` targets resolve single-address network groups.
+- The netns behavioral test harness (rootless).
+
+## 0.2.0 — 2026-07-05
+
+**Breaking:** a strict authoring surface — unknown keys at every level,
+undefined names, empty groups, include and definition cycles, and a missing
+`tables:` fail the build instead of rendering a weaker or empty ruleset;
+`build --check` fails loudly when `nft -c` can't run.
+
+## 0.1.0 — 2026-06-28
+
+The first release: definitions (networks, services, interfaces) with
+composition and per-site overlays; tables, base and regular chains, named
+sets, includes; rule keys for matches, statements (limit, quota, log,
+set-mark, set-mss, counters, flow-offload), tcp flags, icmp types, NAT
+including a dnat port map; inline vmaps (incl. concatenated keys) and
+concatenation sets; `nftgen build <root>` producing one complete
+`flush ruleset` deploy file per host; `nft -c` validation.

nftgen-1.0.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 aeglanee
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

nftgen-1.0.0/PKG-INFO

@@ -0,0 +1,149 @@
+Metadata-Version: 2.4
+Name: nftgen
+Version: 1.0.0
+Summary: nftables firewall generator: YAML definitions and host policies → a native nftables ruleset
+Project-URL: Source, https://github.com/aeglanee/nftgen
+Project-URL: Documentation, https://github.com/aeglanee/nftgen/blob/main/docs/authoring.md
+Project-URL: Changelog, https://github.com/aeglanee/nftgen/blob/main/CHANGELOG.md
+Project-URL: Issues, https://github.com/aeglanee/nftgen/issues
+Author: aeglanee
+License-Expression: MIT
+License-File: LICENSE
+Keywords: ansible,firewall,firewall-as-code,linux,netfilter,nft,nftables
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Environment :: Console
+Classifier: Intended Audience :: System Administrators
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: System :: Networking :: Firewalls
+Requires-Python: >=3.11
+Requires-Dist: pyyaml>=6.0
+Provides-Extra: dev
+Requires-Dist: pre-commit>=4.0; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: ruff==0.15.20; extra == 'dev'
+Requires-Dist: yamllint==1.38.0; extra == 'dev'
+Provides-Extra: test
+Requires-Dist: pytest>=8.0; extra == 'test'
+Description-Content-Type: text/markdown
+
+# nftgen
+
+[![ci](https://github.com/aeglanee/nftgen/actions/workflows/ci.yml/badge.svg)](https://github.com/aeglanee/nftgen/actions/workflows/ci.yml)
+
+A small, **nftables-only** firewall-as-code generator: YAML definitions +
+host policies → one native `.nft` ruleset per host, applied with `nft -f`.
+
+- **It mirrors nftables.** Tables → chains → rules, sets, maps: you write
+  your own chains, and the YAML reads like the ruleset it becomes.
+- **Definitions** (`networks`, `services`, `interfaces`) compose by name,
+  per site; nftgen derives set types, splits rules per address family and
+  keeps each port with its protocol.
+- **Strict.** Unknown keys, undefined names and values of the wrong shape
+  fail the build; nothing is guessed, optimized or injected.
+- **Deterministic.** The same input gives the same bytes, so a diff of the
+  output is a real rule change.
+- **`raw:`** reaches anything nft can do that has no key yet.
+
+## Example
+
+```yaml
+# definitions/networks.yaml
+networks:
+  mgmt: [192.168.9.0/24, fd00:9::/64]
+# definitions/services.yaml
+services:
+  ssh: [22/tcp]
+# policies/hosts/gw1.yaml
+tables:
+  - family: inet
+    name: filter
+    chains:
+      - name: input
+        hook: input
+        rules:
+          - ct: [established, related]
+            action: accept
+          - saddr: mgmt
+            proto: tcp
+            dport: ssh
+            action: accept
+```
+
+`nftgen build .` → `generated/gw1.nft`:
+
+```nft
+table inet filter {
+    chain input {
+        type filter hook input priority 0; policy drop;
+        ct state established,related accept
+        ip saddr 192.168.9.0/24 tcp dport 22 accept
+        ip6 saddr fd00:9::/64 tcp dport 22 accept
+    }
+}
+```
+
+## Use
+
+```bash
+pip install nftgen
+
+nftgen build <root>                       # every host → <root>/generated/
+nftgen build <root> --host gw1 --stdout   # one host to stdout, write nothing
+nftgen build <root> --check               # also validate each file with nft -c
+```
+
+Each output is a complete file (`flush ruleset` + the host's tables) that
+ships as `/etc/nftables.conf`. With Ansible, the
+[ansible-firewall](https://github.com/sessrumnir/ansible-firewall)
+collection renders from inventory variables instead and applies behind a
+rollback timer ([DEPLOYMENT.md][deployment]).
+
+## Docs
+
+- [docs/authoring.md][authoring] — **start here**: firewall
+  structure, adding a rule, which tool to use.
+- [DESIGN.md][design] — the reference: every key and what it renders to.
+- [DECISIONS.md][decisions] — why it's built this way.
+- [docs/best-practices.md][best-practices],
+  [docs/sets-and-performance.md][sets-and-performance],
+  [docs/maps.md][maps], [docs/raw.md][raw] — nftables
+  cookbooks, every example checked with `nft -c`.
+- [example-fleet/][example-fleet] — a realistic 3-site reference;
+  [example/][example] — a small one.
+- [CHANGELOG.md][changelog] · [TODO.md][todo] ·
+  [docs/testing.md][testing].
+
+## Develop
+
+```bash
+make install-dev   # .venv with nftgen (editable), linters, pre-commit hook
+make verify        # lint + tests — put nft and ip on PATH, see docs/testing.md
+```
+
+## License
+
+MIT (see [LICENSE][license]). The definitions model reimplements concepts
+from [Aerleon](https://github.com/aerleon/aerleon) (Apache-2.0) clean-room —
+no Aerleon code is used; the acknowledgment is courtesy, not a license
+obligation.
+
+[authoring]: https://github.com/aeglanee/nftgen/blob/main/docs/authoring.md
+[best-practices]: https://github.com/aeglanee/nftgen/blob/main/docs/best-practices.md
+[changelog]: https://github.com/aeglanee/nftgen/blob/main/CHANGELOG.md
+[decisions]: https://github.com/aeglanee/nftgen/blob/main/DECISIONS.md
+[deployment]: https://github.com/aeglanee/nftgen/blob/main/DEPLOYMENT.md
+[design]: https://github.com/aeglanee/nftgen/blob/main/DESIGN.md
+[example]: https://github.com/aeglanee/nftgen/tree/main/example/
+[example-fleet]: https://github.com/aeglanee/nftgen/tree/main/example-fleet/
+[license]: https://github.com/aeglanee/nftgen/blob/main/LICENSE
+[maps]: https://github.com/aeglanee/nftgen/blob/main/docs/maps.md
+[raw]: https://github.com/aeglanee/nftgen/blob/main/docs/raw.md
+[sets-and-performance]: https://github.com/aeglanee/nftgen/blob/main/docs/sets-and-performance.md
+[testing]: https://github.com/aeglanee/nftgen/blob/main/docs/testing.md
+[todo]: https://github.com/aeglanee/nftgen/blob/main/TODO.md

nftgen-1.0.0/README.md

@@ -0,0 +1,115 @@
+# nftgen
+
+[![ci](https://github.com/aeglanee/nftgen/actions/workflows/ci.yml/badge.svg)](https://github.com/aeglanee/nftgen/actions/workflows/ci.yml)
+
+A small, **nftables-only** firewall-as-code generator: YAML definitions +
+host policies → one native `.nft` ruleset per host, applied with `nft -f`.
+
+- **It mirrors nftables.** Tables → chains → rules, sets, maps: you write
+  your own chains, and the YAML reads like the ruleset it becomes.
+- **Definitions** (`networks`, `services`, `interfaces`) compose by name,
+  per site; nftgen derives set types, splits rules per address family and
+  keeps each port with its protocol.
+- **Strict.** Unknown keys, undefined names and values of the wrong shape
+  fail the build; nothing is guessed, optimized or injected.
+- **Deterministic.** The same input gives the same bytes, so a diff of the
+  output is a real rule change.
+- **`raw:`** reaches anything nft can do that has no key yet.
+
+## Example
+
+```yaml
+# definitions/networks.yaml
+networks:
+  mgmt: [192.168.9.0/24, fd00:9::/64]
+# definitions/services.yaml
+services:
+  ssh: [22/tcp]
+# policies/hosts/gw1.yaml
+tables:
+  - family: inet
+    name: filter
+    chains:
+      - name: input
+        hook: input
+        rules:
+          - ct: [established, related]
+            action: accept
+          - saddr: mgmt
+            proto: tcp
+            dport: ssh
+            action: accept
+```
+
+`nftgen build .` → `generated/gw1.nft`:
+
+```nft
+table inet filter {
+    chain input {
+        type filter hook input priority 0; policy drop;
+        ct state established,related accept
+        ip saddr 192.168.9.0/24 tcp dport 22 accept
+        ip6 saddr fd00:9::/64 tcp dport 22 accept
+    }
+}
+```
+
+## Use
+
+```bash
+pip install nftgen
+
+nftgen build <root>                       # every host → <root>/generated/
+nftgen build <root> --host gw1 --stdout   # one host to stdout, write nothing
+nftgen build <root> --check               # also validate each file with nft -c
+```
+
+Each output is a complete file (`flush ruleset` + the host's tables) that
+ships as `/etc/nftables.conf`. With Ansible, the
+[ansible-firewall](https://github.com/sessrumnir/ansible-firewall)
+collection renders from inventory variables instead and applies behind a
+rollback timer ([DEPLOYMENT.md][deployment]).
+
+## Docs
+
+- [docs/authoring.md][authoring] — **start here**: firewall
+  structure, adding a rule, which tool to use.
+- [DESIGN.md][design] — the reference: every key and what it renders to.
+- [DECISIONS.md][decisions] — why it's built this way.
+- [docs/best-practices.md][best-practices],
+  [docs/sets-and-performance.md][sets-and-performance],
+  [docs/maps.md][maps], [docs/raw.md][raw] — nftables
+  cookbooks, every example checked with `nft -c`.
+- [example-fleet/][example-fleet] — a realistic 3-site reference;
+  [example/][example] — a small one.
+- [CHANGELOG.md][changelog] · [TODO.md][todo] ·
+  [docs/testing.md][testing].
+
+## Develop
+
+```bash
+make install-dev   # .venv with nftgen (editable), linters, pre-commit hook
+make verify        # lint + tests — put nft and ip on PATH, see docs/testing.md
+```
+
+## License
+
+MIT (see [LICENSE][license]). The definitions model reimplements concepts
+from [Aerleon](https://github.com/aerleon/aerleon) (Apache-2.0) clean-room —
+no Aerleon code is used; the acknowledgment is courtesy, not a license
+obligation.
+
+[authoring]: https://github.com/aeglanee/nftgen/blob/main/docs/authoring.md
+[best-practices]: https://github.com/aeglanee/nftgen/blob/main/docs/best-practices.md
+[changelog]: https://github.com/aeglanee/nftgen/blob/main/CHANGELOG.md
+[decisions]: https://github.com/aeglanee/nftgen/blob/main/DECISIONS.md
+[deployment]: https://github.com/aeglanee/nftgen/blob/main/DEPLOYMENT.md
+[design]: https://github.com/aeglanee/nftgen/blob/main/DESIGN.md
+[example]: https://github.com/aeglanee/nftgen/tree/main/example/
+[example-fleet]: https://github.com/aeglanee/nftgen/tree/main/example-fleet/
+[license]: https://github.com/aeglanee/nftgen/blob/main/LICENSE
+[maps]: https://github.com/aeglanee/nftgen/blob/main/docs/maps.md
+[raw]: https://github.com/aeglanee/nftgen/blob/main/docs/raw.md
+[sets-and-performance]: https://github.com/aeglanee/nftgen/blob/main/docs/sets-and-performance.md
+[testing]: https://github.com/aeglanee/nftgen/blob/main/docs/testing.md
+[todo]: https://github.com/aeglanee/nftgen/blob/main/TODO.md

nftgen-1.0.0/example/definitions/interfaces.yaml

@@ -0,0 +1,7 @@
+---
+# Interface groups. Device names (or other groups). Used in rules as iifname / oifname.
+# Note: named distinctly from network groups (lan_if vs the network `lan`) — nft
+# set names are unique per table.
+interfaces:
+  wan: [wan0, wwan0]
+  lan_if: [lan0]

nftgen-1.0.0/example/definitions/networks.yaml

@@ -0,0 +1,25 @@
+---
+# Network groups. A value is a CIDR/IP literal, or the name of another group
+# (composition). Used in rules as saddr / daddr.
+networks:
+  # ----- site subnets (the real addresses; all sites known everywhere) -----
+  users_site1: [192.168.10.0/24]
+  users_site2: [192.168.20.0/24]
+  servers_site1: [192.168.11.0/24]
+  servers_site2: [192.168.21.0/24]
+  mgmt: [192.168.9.0/24]
+  webhosts: [192.0.2.10, 192.0.2.11]
+
+  # ----- bogons / special-use (RFC 6890), for scrubbing -----
+  bogon_ipv4:
+    - 192.0.0.0/24
+    - 192.0.2.0/24
+    - 198.51.100.0/24
+    - 203.0.113.0/24
+    - 240.0.0.0/4
+  no_forward_ipv4:
+    - 0.0.0.0/8
+    - 127.0.0.0/8
+    - 169.254.0.0/16
+    - 224.0.0.0/4
+    - 255.255.255.255/32

nftgen-1.0.0/example/definitions/services.yaml

@@ -0,0 +1,14 @@
+---
+# Service groups. Each port carries its protocol (22/tcp). They emit as a
+# proto-agnostic nft set of ports; the rule states the protocol (tcp dport @web).
+# A group can compose other groups.
+services:
+  ssh: [22/tcp]
+  http: [80/tcp]
+  https: [443/tcp]
+  dns: [53/tcp, 53/udp]
+
+  # composition: a bundle of other services
+  web:
+    - http
+    - https

nftgen-1.0.0/example/policies/hosts/gateway.yaml

@@ -0,0 +1,141 @@
+---
+# gateway.yaml — a showcase exercising every nftgen capability (Phases 0–6).
+#   generate:  nftgen example/policies/hosts/gateway.yaml
+site: site1                                     # per-site overlay: local_users -> site1
+
+tables:
+  - family: inet
+    name: filter
+
+    # 6B — named counters (read with: nft list counter inet filter <name>)
+    counters:
+      - bad_tcp
+      - web_hits
+      - ssh_excess
+
+    # 6C — flowtable; devices resolved from the wan / lan_if interface groups
+    flowtables:
+      - name: ft
+        hook: ingress
+        priority: filter
+        devices: [wan, lan_if]
+
+    # named sets (declared) + a bare, live-populated blocklist
+    sets:
+      - mgmt
+      - webhosts
+      - web
+      - ssh
+      - wan
+      - lan_if
+      - name: blocklist
+        type: ipv4_addr
+        flags: [interval, timeout]
+
+    chains:
+      - name: input
+        hook: input
+        priority: filter
+        policy: drop
+        rules:
+          - ct: [established, related]        # 6C — offload established flows...
+            flow-offload: ft
+          - ct: [established, related]        # ...then accept them (separate
+            action: accept                   #      rule: `flow add` breaks the
+                                             #      rule when it can't offload)
+          - saddr: "@blocklist"
+            counter: true
+            action: drop
+          - vmap: # 6D — dispatch by interface group
+              key: iifname
+              map:
+                wan: # expands to wan0 + wwan0
+                  jump: input_wan
+                lan_if:
+                  jump: input_lan
+
+      - name: input_wan                         # regular chain (reached by the vmap)
+        rules:
+          - flags: # 6E — drop invalid TCP flag combos
+              - match: none
+                mask: all
+              - match: [fin, syn]
+                mask: [fin, syn]
+              - match: [fin]
+                mask: [fin, ack]
+            counter: bad_tcp
+            action: drop
+          - proto: tcp                          # 6A — rate-limit new SSH...
+            dport: ssh
+            ct: [new]
+            limit: 4/minute
+            action: accept
+          - proto: tcp                          # ...log a sample of the excess...
+            dport: ssh
+            limit: 6/minute
+            log:
+              prefix: "ssh-excess "
+              level: info
+          - proto: tcp                          # ...and drop all of it, counted
+            dport: ssh
+            counter: ssh_excess
+            action: drop
+          - proto: tcp
+            dport: web
+            counter: web_hits
+            action: accept
+
+      - name: input_lan
+        rules:
+          - proto: icmp
+            action: accept
+          - saddr: mgmt
+            proto: tcp
+            dport: ssh
+            action: accept
+
+      - name: forward
+        hook: forward
+        priority: filter
+        policy: drop
+        rules:
+          - ct: [established, related]
+            action: accept
+          - proto: tcp
+            set-mss: pmtu                        # 6A — MSS clamp (statement-only)
+          - iifname: lan_if
+            oifname: wan
+            set-mark: "0x1"                      # 6A — fwmark (statement-only)
+          - iifname: lan_if
+            oifname: wan
+            saddr: local_users                   # per-site overlay -> users_site1
+            action: accept
+          - saddr: webhosts                      # 6A — quota: cut off after 10 GiB
+            quota: over 10240 mbytes
+            counter: true
+            action: drop
+
+  - family: inet
+    name: nat
+    chains:
+      - name: prerouting
+        hook: prerouting
+        type: nat
+        priority: dstnat
+        policy: accept
+        rules:
+          - iifname: wan                            # dnat port-forward: family qualifier
+            proto: tcp                          # is inferred from the target (inet
+            dport: 443                          # tables require `dnat ip to`)
+            action:
+              dnat: "192.168.10.50:443"
+
+      - name: postrouting
+        hook: postrouting
+        type: nat
+        priority: srcnat
+        policy: accept
+        rules:
+          - oifname: wan
+            saddr: local_users
+            action: masquerade

nftgen-1.0.0/example/policies/hosts/router1.yaml

@@ -0,0 +1,65 @@
+---
+# router1 — site1 edge router.
+# Layers: COMMON (shared includes) + LOCAL (site1 via `site:`) + UNIQUE (this host).
+# `site:` selects the per-site definitions the generator merges over def/ (later
+# phase) so `local_users` resolves to site1's group.
+site: site1
+
+tables:
+  # ----- raw: early scrubbing (policy accept; only bad traffic dropped) -----
+  - family: inet
+    name: raw
+    sets:
+      - bogon_ipv4
+    chains:
+      - name: prerouting
+        hook: prerouting
+        type: filter
+        priority: raw
+        policy: accept
+        rules:
+          - include: includes/scrub.yaml       # COMMON: bogons + bad-tcp
+
+  # ----- filtering -----
+  - family: inet
+    name: filter
+    sets:
+      - include: includes/common-sets.yaml     # shared named sets
+    chains:
+      - name: input
+        hook: input
+        priority: filter
+        policy: drop
+        rules:
+          - ct: [established, related]
+            action: accept
+          - include: includes/common-input.yaml   # COMMON: icmp + ssh-from-mgmt
+          - saddr: webhosts                        # UNIQUE: this host serves web
+            proto: tcp
+            dport: web
+            counter: true
+            action: accept
+
+      - name: forward
+        hook: forward
+        priority: filter
+        policy: drop
+        rules:
+          - ct: [established, related]
+            action: accept
+          - include: includes/common-forward.yaml  # COMMON: no-forward + mss
+          - include: includes/local-egress.yaml     # LOCAL: local_users -> users_site1
+
+  # ----- NAT -----
+  - family: inet
+    name: nat
+    chains:
+      - name: postrouting
+        hook: postrouting
+        type: nat
+        priority: srcnat
+        policy: accept
+        rules:
+          - oifname: wan
+            saddr: local_users                      # LOCAL: site1 users
+            action: masquerade