#!/usr/sbin/nft -f
# www.azit.se host firewall: inbound 22/80/443 only, outbound open.
# Installed as /etc/nftables.conf; loaded at boot by nftables.service.

flush ruleset

table inet filter {
	set ssh_v4 {
		type ipv4_addr
		flags dynamic
		timeout 1m
	}
	set ssh_v6 {
		type ipv6_addr
		flags dynamic
		timeout 1m
	}

	chain input {
		type filter hook input priority filter; policy drop;

		ct state established,related accept
		ct state invalid drop
		iif "lo" accept

		icmp type echo-request accept
		meta l4proto ipv6-icmp accept

		tcp dport 22 ct state new add @ssh_v4 { ip saddr limit rate over 10/minute } drop
		tcp dport 22 ct state new add @ssh_v6 { ip6 saddr limit rate over 10/minute } drop
		tcp dport { 22, 80, 443 } ct state new accept
	}

	chain forward {
		type filter hook forward priority filter; policy drop;
	}

	chain output {
		type filter hook output priority filter;
	}
}