#!/usr/sbin/nft -f
# The robot's audio (4713), MCP (8765) and face webhook (8766) ports are reachable only over the
# USB link, and only from the host at 10.55.0.1. Every other interface, Wi-Fi included, is dropped.
# ROS 2 never leaves the robot: its DDS has no authentication, and /camera/* and /vision/faces
# carry video and recognised names. Domain 42's ports (17900-18149 with Fast DDS's default offsets)
# are dropped on every interface but loopback, usb0 included. The only way in or out is hermes_mcp,
# which talks to the ROS graph locally and to the host over MCP.
# SSH and everything else are left alone: that policy is the owner's call.

table inet robot
delete table inet robot

table inet robot {
    chain input {
        type filter hook input priority 0; policy accept;
        iif "lo" accept
        iifname "usb0" ip saddr 10.55.0.1 tcp dport { 4713, 8765, 8766 } accept
        tcp dport { 4713, 8765, 8766 } drop
        iifname != "lo" udp dport 17900-18149 drop
    }
}