Gecko [ unitednationsplay.com ]

Name	Size	Permission	Date
osf	[ DIR ]	drwx------	2020-10-30 04:15
main.nft	1.66 KB	-rw-------	2020-10-30 04:15
nat.nft	743 B	-rw-------	2020-10-30 04:15
router.nft	407 B	-rw-------	2020-10-30 04:15

Rename

# Sample configuration for nftables service.
# Load this by calling 'nft -f /etc/nftables/main.nft'.

# Note about base chain priorities:
# The priority values used in these sample configs are
# offset by 20 in order to avoid ambiguity when firewalld
# is also running which uses an offset of 10. This means
# that packets will traverse firewalld first and if not
# dropped/rejected there will hit the chains defined here.
# Chains created by iptables, ebtables and arptables tools
# do not use an offset, so those chains are traversed first
# in any case.

# drop any existing nftables ruleset
flush ruleset

# a common table for both IPv4 and IPv6
table inet nftables_svc {

# protocols to allow
	set allowed_protocols {
		type inet_proto
		elements = { icmp, icmpv6 }
	}

# interfaces to accept any traffic on
	set allowed_interfaces {
		type ifname
		elements = { "lo" }
	}

# services to allow
	set allowed_tcp_dports {
		type inet_service
		elements = { ssh, 9090 }
	}

# this chain gathers all accept conditions
	chain allow {
		ct state established,related accept

meta l4proto @allowed_protocols accept
		iifname @allowed_interfaces accept
		tcp dport @allowed_tcp_dports accept
	}

# base-chain for traffic to this host
	chain INPUT {
		type filter hook input priority filter + 20
		policy accept

jump allow
		reject with icmpx type port-unreachable
	}
}

# By default, any forwarding traffic is allowed.
# Uncomment the following line to filter it based
# on the same criteria as input traffic.
#include "/etc/nftables/router.nft"

# Uncomment the following line to enable masquerading of
# forwarded traffic. May be used with or without router.nft.
#include "/etc/nftables/nat.nft"