#!/usr/sbin/nft -f

flush ruleset

table inet filter {
  chain input_ipv4 {
    icmp type echo-request limit rate 5/second accept
  }

  chain input_ipv6 {
    icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept
    icmpv6 type echo-request limit rate 5/second accept
  }

  chain input {
    type filter hook input priority filter; policy drop;
    ct state vmap { established : accept, related : accept, invalid : drop }
    iifname lo accept
    meta protocol vmap { ip : jump input_ipv4, ip6 : jump input_ipv6 }
    tcp dport { ssh, http, https, 993, 465, 25, 587 } accept
    log prefix "(nftables) input denied: " counter drop
  }
}