#!/sbin/nft -f
# vim:set ts=4:

# Clear all prior state
flush ruleset

table ip mangle {
    chain PREROUTING {
        type filter hook prerouting priority mangle; policy accept;
    }

    chain INPUT {
        type filter hook input priority mangle; policy accept;
    }

    chain FORWARD {
        type filter hook forward priority mangle; policy accept;
    }

    chain OUTPUT {
        type route hook output priority mangle; policy accept;
    }

    chain POSTROUTING {
        type filter hook postrouting priority mangle; policy accept;
    }
}
table ip raw {
    chain PREROUTING {
        type filter hook prerouting priority raw; policy accept;
    }

    chain OUTPUT {
        type filter hook output priority raw; policy accept;
    }
}
table inet filter {
    chain INPUT {
        type filter hook input priority filter; policy drop;
        ct state { established, related } counter accept
        iifname "lo" counter accept
        # icmp, rate limited
        icmp type { echo-request } limit rate 4/second accept
        icmpv6 type { echo-request } limit rate 4/second accept
        # allow dns, ssh, http, https resolution from another pc
        tcp dport { 22, 51022 } counter accept comment "OpenSSH"
        tcp dport 53 counter accept comment "accept DNS from TCP"
        udp dport 53 counter accept comment "accept DNS from UDP"
        tcp dport { 80, 443 } counter accept comment "WWW Full"
        counter comment "count input dropped packets"
        # log all remaining packets
        ip protocol { tcp } counter log prefix "tcp.out.dropped: "
        ip protocol { udp } counter log prefix "udp.out.dropped: "
    }

    chain FORWARD {
        type filter hook forward priority filter; policy drop;
        counter comment "count forward dropped packets"
    }

    chain OUTPUT {
        type filter hook output priority filter; policy drop;
        ct state { established, related } counter accept
        oifname "lo" counter accept
        # DNS lookups myself
        udp dport { 53 } accept
        tcp sport 1024-65535 counter accept
        udp sport 1024-65535 counter accept
        counter comment "count forward dropped packets"
        ip protocol { tcp } counter log prefix "tcp.out.dropped: "
        ip protocol { udp } counter log prefix "udp.out.dropped: "
    }
}
table ip nat {
    chain PREROUTING {
        type nat hook prerouting priority dstnat; policy accept;
    }

    chain INPUT {
        type nat hook input priority 100; policy accept;
    }

    chain OUTPUT {
        type nat hook output priority -100; policy accept;
    }

    chain POSTROUTING {
        type nat hook postrouting priority srcnat; policy accept;
    }
}