From 41dbce364182f547a98f8766a9a64c0839593aff Mon Sep 17 00:00:00 2001
From: Ruakij <ruakij@ruekov.eu>
Date: Sat, 24 Oct 2026 08:40:31 +0000
Subject: [PATCH] host_firewall: admin.tcp ports answer the admin set alone,
 never the geo sets

---
 host_firewall/defaults/main.yml     |  2 ++
 host_firewall/templates/host.nft.j2 | 10 ++++++++++
 2 files changed, 12 insertions(+)

diff --git a/host_firewall/defaults/main.yml b/host_firewall/defaults/main.yml
index 3ccc87c..98702f1 100644
--- a/host_firewall/defaults/main.yml
+++ b/host_firewall/defaults/main.yml
@@ -13,7 +13,9 @@ firewall:
   vpn:
     tcp: {}
     udp: {}
+  # tcp: ports accepted from the admin set alone, never from the geo sets.
   admin:
+    tcp: {}
     v4: {}
     v6: {}
   # Metrics scrapers: on wt0 only these source addresses reach the listed tcp
diff --git a/host_firewall/templates/host.nft.j2 b/host_firewall/templates/host.nft.j2
index 75bf894..16ee621 100644
--- a/host_firewall/templates/host.nft.j2
+++ b/host_firewall/templates/host.nft.j2
@@ -113,8 +113,18 @@ table inet host {
 {% endif %}
 {% if list(firewall.geo.tcp) %}
 		tcp dport { {{ list(firewall.geo.tcp) }} } jump geo
+{% endif %}
+{% if list(firewall.admin.tcp) %}
+		tcp dport { {{ list(firewall.admin.tcp) }} } jump admin
 {% endif %}
 	}
+{% if list(firewall.admin.tcp) %}
+
+	chain admin {
+		ip saddr @admin_v4 accept
+		ip6 saddr @admin_v6 accept
+	}
+{% endif %}
 
 	chain geo {
 {% if guest_ifaces %}