#!/usr/sbin/nft -f

flush ruleset

table inet filter {
    chain input {
        type filter hook input priority 0;
        policy drop;

        # loopback
        iif lo accept
        ip saddr 127.0.0.2/8 accept
        ip6 saddr ::1 accept

        # allow established/related
        ct state established,related accept

        # allow SSH
        tcp dport 22 accept

        # allow ping
        ip protocol icmp accept
        ip6 nexthdr icmpv6 accept

        # log dropped packets (optional)
        # log prefix "nftables denied: " counter drop
    }

    chain forward {
        type filter hook forward priority 0;
        policy drop;
    }

    chain output {
        type filter hook output priority 0;
        policy accept;
    }
}