add Anti-spoof rules

@jow-
@brada4

Hi devs, can you add anti-spoof rules to the owrt firewall? This will not change anything conceptual it will do just some hardening. Loopback interfaces and loopback ip addresses (ipv4 and ipv6) should never be accessed from the wan. These are for the services running on router itself (such as dnsmasq, unbound etc.). Almost every linux distro has these rules in forewall. I opened ticked here At least consider making it optional like with syn-flood rule.

So, something like this:

table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;

        # 1. Allow traffic loopback interface
        iif "lo" accept

        # 2. Drop traffic claiming to be local from external interfaces
        iif != "lo" ip saddr 127.0.0.0/8 drop
        iif != "lo" ip6 saddr ::1 drop

        # ... rest of rules
    }
}

or even stronger protection, with netdev ingress chain (earlier than prerouting) lets say eth0 is wanface:

table netdev anti_spoof {
    chain ingress {
        type filter hook ingress device eth0 priority 0;

        ip saddr 127.0.0.0/8 drop
        ip6 saddr ::1 drop

    }
}

No file, test, or entry point is named. Start by reviewing the requested loopback and source-address protections alongside the linked LuCI discussion; done means the project has a settled choice between mandatory or optional rules and verified behavior for WAN traffic over IPv4 and IPv6.