host_firewall: GreenSnow set greensnow_v4 drops inbound new connections of the listed hosts

host_firewall/templates/host.nft.j2

@@ -82,6 +82,9 @@ include "/etc/nftables.d/host-firehol.nft"
 {% if firewall.scanners %}
 include "/etc/nftables.d/host-scanners.nft"
 {% endif %}
+{% if firewall.greensnow %}
+include "/etc/nftables.d/host-greensnow.nft"
+{% endif %}
 
 table inet host {
 	{{ addr_set('admin_v4', 'ipv4_addr', firewall.admin.v4) }}
@@ -154,6 +157,12 @@ table inet host {
 		ip saddr @scanners_v4 jump scanners_in
 		ip6 saddr @scanners_v6 jump scanners_in
 
+{% endif %}
+{% if firewall.greensnow %}
+
+		# After the established rule: only inbound connections of GreenSnow hosts drop.
+		ip saddr @greensnow_v4 jump greensnow_in
+
 {% endif %}
 		ct state invalid jump drop_log
 		iif lo accept
@@ -317,6 +326,16 @@ table inet host {
 		drop
 	}
 {% endif %}
+{% if firewall.greensnow %}
+
+	# Own limit and prefix, so GreenSnow hits use up neither the fw-in-drop budget
+	# nor the one of the blocklists. CrowdSec whitelists the prefix: the listed
+	# hosts are known and need no decision.
+	chain greensnow_in {
+		limit rate {{ firewall.log.spamhaus_rate }} log prefix "fw-greensnow-in: "
+		drop
+	}
+{% endif %}
 {% if firewall.block_smtp_out or blocklists %}
 
 	# Outbound mail goes through the mail host only. Loopback stays open for a
@@ -394,7 +413,7 @@ table inet host {
 		ip6 saddr @geo_v6 accept
 {% endif %}
 	}
-{% if forward_guard or blocklists or firewall.scanners or rl_forward %}
+{% if forward_guard or blocklists or firewall.scanners or firewall.greensnow or rl_forward %}
 
 	chain forward {
 		type filter hook forward priority filter; policy accept;
@@ -423,6 +442,10 @@ table inet host {
 		ct state new ip saddr @scanners_v4 jump scanners_in
 		ct state new ip6 saddr @scanners_v6 jump scanners_in
 {% endif %}
+{% if firewall.greensnow %}
+
+		ct state new ip saddr @greensnow_v4 jump greensnow_in
+{% endif %}
 {% for guard in forward_guard %}
 
 		# {{ guard.key }}