#!/usr/sbin/nft -f

flush ruleset

table inet filter {
    chain input {
        type filter hook input priority filter; policy drop;
        # Accept loopback
        iif "lo" accept
        # Drop fragments
        ip frag-off & 0x1fff != 0x0 drop
        # Accept ICMP
        ip protocol icmp accept
        ip6 nexthdr ipv6-icmp accept
        # Drop TCP non-SYN new connections
        tcp flags != syn ct state new drop
        # Drop XMAS and NULL scans
        tcp flags & (fin | syn | rst | psh | ack | urg) == fin | syn | rst | psh | ack | urg drop
        tcp flags ! fin,syn,rst,psh,ack,urg drop
        # Accept established/related
        ct state established,related accept
    }
    chain forward {
        type filter hook forward priority filter;
    }
    chain output {
        type filter hook output priority filter;
    }
}

include "/etc/nftables.conf.d/*.set"
include "/etc/nftables.conf.d/*.conf"
