host_firewall: log dropped inbound packets with a global rate limit and reject outbound TCP 25 except on the mail host

host_firewall/templates/host.nft.j2

@@ -50,7 +50,7 @@ table inet host {
 		type filter hook input priority filter; policy drop;
 
 		ct state established,related accept
-		ct state invalid drop
+		ct state invalid jump drop_log
 		iif lo accept
 
 		icmp type { echo-request, destination-unreachable, time-exceeded, parameter-problem } accept
@@ -85,8 +85,31 @@ table inet host {
 		# VPN peers get the vpn ports, then everything public.
 		iifname "wt0" jump vpn
 		jump public
+
+		# Broadcasts and multicasts are never scans; they stay out of the log.
+		meta pkttype { broadcast, multicast } drop
+		jump drop_log
 	}
 
+	# A single rule makes the limit global: a flood logs at the limit and the
+	# rest drops silently. The kernel log line has the iptables LOG fields that
+	# the CrowdSec iptables-logs parser reads.
+	chain drop_log {
+		limit rate {{ firewall.log.in_rate }} log prefix "fw-in-drop: "
+		drop
+	}
+{% if firewall.block_smtp_out %}
+
+	# Outbound mail goes through the mail host only. Loopback stays open for a
+	# local MTA; the log lines carry OUT=, which CrowdSec does not count as a scan.
+	chain output {
+		type filter hook output priority filter; policy accept;
+
+		oifname != "lo" tcp dport 25 limit rate {{ firewall.log.out_rate }} log prefix "fw-out-reject: "
+		oifname != "lo" tcp dport 25 reject with tcp reset
+	}
+{% endif %}
+
 	chain vpn {
 {% if list(scrapers.tcp) %}
 {% if list(scrapers.v4) %}
@@ -133,9 +156,9 @@ table inet host {
 {% endif %}
 		ip saddr @admin_v4 accept
 		ip6 saddr @admin_v6 accept
-		tcp dport 22 ct state new update @ssh_meter_v4 { ip saddr limit rate over {{ firewall.ssh_rate_limit }} } drop
+		tcp dport 22 ct state new update @ssh_meter_v4 { ip saddr limit rate over {{ firewall.ssh_rate_limit }} } jump drop_log
 		# One IPv6 client usually holds a whole /64.
-		tcp dport 22 ct state new update @ssh_meter_v6 { ip6 saddr & ffff:ffff:ffff:ffff:: limit rate over {{ firewall.ssh_rate_limit }} } drop
+		tcp dport 22 ct state new update @ssh_meter_v6 { ip6 saddr & ffff:ffff:ffff:ffff:: limit rate over {{ firewall.ssh_rate_limit }} } jump drop_log
 {% if firewall.geo_countries %}
 		ip saddr @geo_v4 accept
 		ip6 saddr @geo_v6 accept
@@ -162,7 +185,7 @@ table inet host {
 {% if list(zone.icmp) %}
 		{{ match }} {{ icmp }} type { {{ list(zone.icmp) }} } accept
 {% endif %}
-		{{ match }} drop
+		{{ match }} jump drop_log
 {% endfor %}
 {% endfor %}
 	}