#!/usr/sbin/nft -f
add table inet nat
add table inet filter
add table ip6 nat
delete table inet nat
delete table inet filter
delete table ip6 nat
add table inet nat
add table inet filter
add table ip6 nat
add chain inet filter input { type filter hook input priority 0; policy drop; }
add chain inet filter forward { type filter hook forward priority 0; policy drop; }
add chain inet filter output { type filter hook output priority 0; policy drop; }
add chain inet nat prerouting { type nat hook prerouting priority -100; }
add chain inet nat output { type nat hook output priority -100; }
add chain ip6 nat output { type nat hook output priority -100; }
add rule inet filter input ct state invalid counter drop
add rule inet filter input tcp flags & (fin|syn|rst|psh|ack|urg) == fin|syn|rst|ack counter drop
add rule inet filter input tcp flags & (fin|syn) == fin|syn counter drop
add rule inet filter input tcp flags & (syn|rst) == syn|rst counter drop
add rule inet filter input ip frag-off & 0x1fff != 0 counter drop
add rule inet filter input tcp flags & (fin|syn|rst|psh|ack|urg) == fin|syn|rst|psh|ack|urg counter drop
add rule inet filter input tcp flags & (fin|syn|rst|psh|ack|urg) == 0x0 counter drop
add rule inet filter input iifname lo counter accept
add rule inet filter input ct state established counter accept
add rule inet filter input icmp type destination-unreachable icmp code frag-needed ct state related counter accept
add rule inet filter input icmpv6 type packet-too-big ct state related counter accept
add rule inet filter input icmpv6 type { nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, nd-redirect } counter accept
add rule inet filter input ip protocol icmp counter drop
add rule inet filter input ip6 nexthdr icmpv6 counter drop
add rule inet filter input counter drop
add rule inet filter forward counter reject
add rule inet filter output ct state invalid counter reject
add rule inet filter output tcp flags & (fin|syn|rst|psh|ack|urg) == fin|syn|rst|ack counter reject
add rule inet filter output tcp flags & (fin|syn) == fin|syn counter reject
add rule inet filter output tcp flags & (syn|rst) == syn|rst counter reject
add rule inet filter output ip frag-off & 0x1fff != 0 counter reject
add rule inet filter output tcp flags & (fin|syn|rst|psh|ack|urg) == fin|syn|rst|psh|ack|urg counter reject
add rule inet filter output tcp flags & (fin|syn|rst|psh|ack|urg) == 0x0 counter reject
add rule inet filter output oifname lo counter accept
add rule inet filter output ct state established counter accept
add rule inet filter output icmpv6 type { nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, nd-redirect } counter accept
add rule inet filter output ip daddr 192.168.1.0/24 counter accept
add rule inet filter output ip daddr 192.168.0.0/24 counter accept
add rule inet filter output ip daddr 127.0.0.0/8 counter accept
add rule inet filter output ip daddr 10.152.152.0/24 counter accept
add rule inet filter output ip daddr 10.0.2.2/24 counter accept
add rule inet filter output ip6 daddr ::1/128 counter accept
add rule inet filter output ip6 daddr fd19:c33d:88bc::0/96 counter accept
add rule inet filter output ip6 daddr ::ffff:192.168.1.0/120 counter accept
add rule inet filter output ip6 daddr ::ffff:192.168.0.0/120 counter accept
add rule inet filter output ip6 daddr ::ffff:127.0.0.0/104 counter accept
add rule inet filter output ip6 daddr ::ffff:10.152.152.0/120 counter accept
add rule inet filter output ip6 daddr ::ffff:10.0.2.2/120 counter accept
add rule inet filter output skuid 103 counter accept
add rule inet filter output counter reject
