fix: make ingress firewall filter traffic to nodeports

This fixes #10347

The core issue was that Talos nftables chain had priority 0 (`filter`),
while kube-proxy does DNAT for node ports at priority -110 (before Talos
can see source traffic), so Talos rule doesn't match.

Move Talos priority to -140, so it runs before kube-proxy.

Signed-off-by: Andrey Smirnov <[email protected]>
(cherry picked from commit 9463ac2)

Author: smira

hack/release.toml

@@ -22,6 +22,12 @@ preface = """
 * Flannel: 0.26.4
 
 Talos is built with Go 1.23.6.
+"""
+
+    [notes.ingress-firewall]
+        title = "Ingress Firewall"
+        description = """\
+Talos Ingress Firewall now filters access to Kubernetes NodePort services correctly.
 """
 
 [make_deps]

internal/app/machined/pkg/controllers/network/nftables_chain_config.go

@@ -83,7 +83,7 @@ func (ctrl *NfTablesChainConfigController) Run(ctx context.Context, r controller
 
 					spec.Type = nethelpers.ChainTypeFilter
 					spec.Hook = nethelpers.ChainHookInput
-					spec.Priority = nethelpers.ChainPriorityFilter
+					spec.Priority = nethelpers.ChainPriorityMangle + 10
 					spec.Policy = nethelpers.VerdictAccept
 
 					// preamble

internal/app/machined/pkg/controllers/network/nftables_chain_config_test.go

@@ -87,7 +87,7 @@ func (suite *NfTablesChainConfigTestSuite) TestDefaultAccept() {
 		spec := chain.TypedSpec()
 
 		asrt.Equal(nethelpers.ChainTypeFilter, spec.Type)
-		asrt.Equal(nethelpers.ChainPriorityFilter, spec.Priority)
+		asrt.Equal(nethelpers.ChainPriorityMangle+10, spec.Priority)
 		asrt.Equal(nethelpers.ChainHookInput, spec.Hook)
 		asrt.Equal(nethelpers.VerdictAccept, spec.Policy)
 
@@ -165,7 +165,7 @@ func (suite *NfTablesChainConfigTestSuite) TestDefaultBlock() {
 		spec := chain.TypedSpec()
 
 		asrt.Equal(nethelpers.ChainTypeFilter, spec.Type)
-		asrt.Equal(nethelpers.ChainPriorityFilter, spec.Priority)
+		asrt.Equal(nethelpers.ChainPriorityMangle+10, spec.Priority)
 		asrt.Equal(nethelpers.ChainHookInput, spec.Hook)
 		asrt.Equal(nethelpers.VerdictDrop, spec.Policy)