host_firewall: uplinks drop new forwarded connections that were not DNATed, replaces no_hairpin_ifaces

host_firewall/defaults/main.yml

@@ -116,10 +116,11 @@ firewall:
   # of any host, and ones holding an address of the host are left out
   # (/etc/nft-host-scanners.allowlist). Refreshed daily by nft-host-scanners.
   scanners: true
-  # Bridges and uplinks whose forwarded traffic may not leave through the interface it came in on (iifname X oifname X
-  # drop). The datacenter gateway routes packets for foreign addresses of the subnet to the host; with ip_forward they
-  # would be forwarded back out and masqueraded with the host address. Not for a bridge that carries guests.
-  no_hairpin_ifaces: {}
+  # Uplink interfaces (name -> interface). New forwarded connections that arrive on one are dropped unless they were
+  # DNATed here or a forward_guard zone admits the destination. The datacenter gateway routes packets for foreign
+  # addresses of the subnet to the host; with ip_forward they would be forwarded and masqueraded with the host address.
+  # Not for hosts whose forwarded inbound traffic is not DNATed in netfilter (Cilium NodePorts are DNATed in BPF).
+  uplinks: {}
   # Reject outbound TCP 25; the mail group turns it off.
   block_smtp_out: true
   # EU-27 plus CH, NO, GB, IS, LI (ipdeny country codes). Empty leaves the geo