roles/dch-gw: Configure the filter table

The *filter* table is responsible for deciding which packets will be
accepted and which will be rejected. It has three chains, which classify
packets according to whether they are destined for the local machine
(input), passing through this machine (forward) or originating from the
local machine (output).

The *dch-gw* role now configures all three chains in this table. For
now, it defines basic rules, mostly based on TCP/UDP destination port:

* Traffic destined for a service hosted by the local machine (DNS, DHCP,
  SSH), is allowed if it does not come from the Internet
* Traffic passing through the machine is allowed if:
  * It is passing between internal networks
  * It is destined for a host on the FireMon network (VPN)
  * It was NATed to in internal host (marked 323)
  * It is destined for the Internet
* Only DHCP, HTTP, and DNS are allowed to originate from the local
machine

This configuration requires an `internet_iface` variable, which
indicates the name of the network interface connected to the Internet
directly.

roles/dch-gw/templates/forward.nft.j2

@@ -0,0 +1,23 @@
+{#- vim: set sw=4 ts=4 sts=4 et : #}
+table inet filter {
+    set firemon {
+        type ipv4_addr
+        flags interval
+        elements = {
+{% for prefix in firemon_networks %}
+            {{ prefix }},
+{% endfor %}
+        }
+    }
+
+    chain forward {
+        ct state established,related accept
+        iifname {{ dch_networks.guest.router_iface }} oif != {{ internet_iface }} drop
+        iif != {{ internet_iface }} oifname {{ dch_networks.guest.router_iface }} drop
+        iif != {{ internet_iface }} oif != {{ internet_iface }} counter accept
+        ip daddr @firemon counter accept
+        mark 323 counter accept
+        tcp dport smtp counter reject with icmpx type host-unreachable
+        oif {{ internet_iface }} accept
+    }
+}