{{ ansible_managed | comment }}

table inet wgrelay
delete table inet wgrelay

table inet wgrelay {
    chain input {
        type filter hook input priority 0; policy accept;

        ct state established,related accept
        ct state invalid drop

        # --- traffic arriving over the tunnel -------------------------------
        # Ping across the tunnel is useful for debugging and harmless.
        iifname "{{ wg_interface }}" icmp type echo-request accept
        iifname "{{ wg_interface }}" icmpv6 type echo-request accept

{% for r in relays if r.direction == 'inbound' %}
        # {{ r.name }}: only {{ r.source_allow }} may reach this listener
        iifname "{{ wg_interface }}" ip saddr {{ r.source_allow }} tcp dport {{ r.listen_port }} accept
{% endfor %}

        # Anything else off the tunnel is not ours. This is the rule that
        # makes "one port, one host" true rather than aspirational.
        iifname "{{ wg_interface }}" counter drop

        # --- LAN-facing relay listeners -------------------------------------
{% for r in relays if r.direction == 'outbound' %}
        iifname != "{{ wg_interface }}" ip saddr {{ r.source_allow }} tcp dport {{ r.listen_port }} accept
        tcp dport {{ r.listen_port }} counter drop
{% endfor %}
    }

    chain forward {
        type filter hook forward priority 0; policy drop;
        # Nothing is routed through this box, by design. Combined with
        # net.ipv4.ip_forward=0 this is belt and braces.
        counter
    }
}