host_firewall: admin.tcp ports answer the admin set alone, never the geo sets

host_firewall/defaults/main.yml

@@ -13,7 +13,9 @@ firewall:
   vpn:
     tcp: {}
     udp: {}
+  # tcp: ports accepted from the admin set alone, never from the geo sets.
   admin:
+    tcp: {}
     v4: {}
     v6: {}
   # Metrics scrapers: on wt0 only these source addresses reach the listed tcp

host_firewall/templates/host.nft.j2

@@ -113,8 +113,18 @@ table inet host {
 {% endif %}
 {% if list(firewall.geo.tcp) %}
 		tcp dport { {{ list(firewall.geo.tcp) }} } jump geo
+{% endif %}
+{% if list(firewall.admin.tcp) %}
+		tcp dport { {{ list(firewall.admin.tcp) }} } jump admin
 {% endif %}
 	}
+{% if list(firewall.admin.tcp) %}
+
+	chain admin {
+		ip saddr @admin_v4 accept
+		ip6 saddr @admin_v6 accept
+	}
+{% endif %}
 
 	chain geo {
 {% if guest_ifaces %}