gistfile1.txt

#!/usr/sbin/nft -f

flush ruleset

define local = {192.168.16.0/24, 127.0.0.0/8 }
define out_if = enp0s3

table nat {
	chain prerouting {
		type nat hook prerouting priority 0;
		ip protocol tcp redirect to :9040
		ip protocol udp redirect to :9053
	}

	chain postrouting {
		type nat hook postrouting priority 100;
	}
}

table filter {
	chain input {
		type filter hook input priority 0;
		ct state {established, related} counter accept

		iif == lo accept
		ip saddr $local accept

		counter log level err prefix "INPUT REJECTED: " reject
	}

	chain output {
		type filter hook output priority 0;
		ct state {established, related} counter accept

		oif == lo accept
		skuid == debian-tor accept
		ip daddr $local accept

		counter log level err prefix "OUTPUT REJECTED: " reject
	}
}