import type { SmartNftables } from './nft.manager.js';
import type { INftFirewallRule, INftIPSetBlockOptions, INftIPSetConfig } from './nft.types.js';
/**
 * Manages firewall (filter) rules, IP sets, and convenience methods.
 */
export declare class FirewallManager {
    private parent;
    constructor(parent: SmartNftables);
    /**
     * Add a firewall rule (input/output/forward).
     */
    addRule(groupId: string, rule: INftFirewallRule): Promise<void>;
    /**
     * Remove a firewall rule group.
     */
    removeRule(groupId: string): Promise<void>;
    /**
     * Create a named IP set.
     */
    createIPSet(config: INftIPSetConfig): Promise<void>;
    /**
     * Add elements to an existing IP set.
     */
    addToIPSet(setName: string, elements: string[]): Promise<void>;
    /**
     * Remove elements from an IP set.
     */
    removeFromIPSet(setName: string, elements: string[]): Promise<void>;
    /**
     * Delete an IP set entirely.
     */
    deleteIPSet(setName: string): Promise<void>;
    /**
     * Convenience: block an IP or CIDR subnet.
     */
    blockIP(ip: string, options?: {
        direction?: 'input' | 'forward';
    }): Promise<void>;
    /**
     * Convenience: block many IPs or CIDR subnets using one nftables set and
     * one matching drop rule. This is substantially cheaper than one rule per IP.
     */
    blockIPSet(groupId: string, options: INftIPSetBlockOptions): Promise<void>;
    /**
     * Convenience: allow only specific IPs on a port.
     * Adds accept rules for each IP, then a drop rule for everything else on that port.
     */
    allowOnlyIPs(groupId: string, ips: string[], port?: number, protocol?: 'tcp' | 'udp' | 'both'): Promise<void>;
    /**
     * Convenience: enable stateful connection tracking.
     * Allows established+related, drops invalid.
     */
    enableStatefulTracking(chain?: 'input' | 'forward' | 'output'): Promise<void>;
}