etc/nftables.conf


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

#!/usr/bin/nft -f

# IPv4/IPv6 Simple & Safe firewall ruleset.
# More examples in /usr/share/nftables/ and /usr/share/doc/nftables/examples/.

# some codes from https://wiki.archlinux.org/title/Nftables

table inet my_table {

	chain my_input {
		type filter hook input priority filter
		policy drop

		ct state invalid drop comment "early drop of invalid connections"
		ct state {established, related} accept comment "allow tracked connections"
		iifname lo accept comment "allow from loopback"
		ip protocol icmp accept comment "allow icmp"
		meta l4proto ipv6-icmp accept comment "allow icmp v6"
		tcp dport ssh accept comment "allow sshd"
		pkttype host limit rate 5/second counter reject with icmpx type admin-prohibited
		counter comment "count any other traffic"
	}

	chain my_forward {
		type filter hook forward priority filter
		policy drop
		# Drop everything forwarded to us. We do not forward. That is routers job.
	}

	chain my_output {
		type filter hook output priority filter
		policy accept
		# Accept every outbound connection
	}
}