#!/usr/sbin/nft -f
add table inet filter
add table inet nat
delete table inet filter
delete table inet nat
add table inet filter
add table inet nat
add chain inet nat output
add chain inet nat prerouting
add chain inet filter input { type filter hook input priority 0; policy drop; }
add chain inet filter forward { type filter hook forward priority 0; policy drop; }
add chain inet filter output { type filter hook output priority 0; policy drop; }
add rule inet filter input ct state invalid counter drop
add rule inet filter input tcp flags & (fin|syn|rst|psh|ack|urg) == fin|syn|rst|ack counter drop
add rule inet filter input tcp flags & (fin|syn) == fin|syn counter drop
add rule inet filter input tcp flags & (syn|rst) == syn|rst counter drop
add rule inet filter input ip frag-off & 0x1fff != 0 counter drop
add rule inet filter input tcp flags & (fin|syn|rst|psh|ack|urg) == fin|syn|rst|psh|ack|urg counter drop
add rule inet filter input tcp flags & (fin|syn|rst|psh|ack|urg) == 0x0 counter drop
add rule inet filter input iifname lo counter accept
add rule inet filter input ct state established counter accept
add rule inet filter input icmpv6 type { nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, nd-redirect } counter accept
add rule inet filter input ip protocol tcp counter reject with tcp reset
add rule inet filter input counter reject
add rule inet filter forward counter drop
add rule inet filter output ct state invalid counter reject
add rule inet filter output tcp flags & (fin|syn|rst|psh|ack|urg) == fin|syn|rst|ack counter reject
add rule inet filter output tcp flags & (fin|syn) == fin|syn counter reject
add rule inet filter output tcp flags & (syn|rst) == syn|rst counter reject
add rule inet filter output ip frag-off & 0x1fff != 0 counter reject
add rule inet filter output tcp flags & (fin|syn|rst|psh|ack|urg) == fin|syn|rst|psh|ack|urg counter reject
add rule inet filter output tcp flags & (fin|syn|rst|psh|ack|urg) == 0x0 counter reject
add rule inet filter output oifname lo counter accept
add rule inet filter output ip daddr 10.152.152.10 udp dport 53 counter accept
add rule inet filter output ip6 daddr fd19:c33d:88bc::10 udp dport 53 counter accept
add rule inet filter output ip daddr 10.152.152.10 udp dport 53 counter accept
add rule inet filter output ip6 daddr fd19:c33d:88bc::10 udp dport 53 counter accept
add rule inet filter output ip protocol != tcp counter reject
add rule inet filter output ip protocol tcp ip daddr 198.51.100.1 counter accept
add rule inet filter output ip6 nexthdr tcp ip6 daddr ::ffff:198.51.100.1 counter accept
add rule inet filter output ip protocol tcp ip daddr 203.0.113.5 counter accept
add rule inet filter output ip6 nexthdr tcp ip6 daddr ::ffff:203.0.113.5 counter accept
add rule inet filter output counter reject
