Skip to content

Instantly share code, notes, and snippets.

What would you like to do?
Simple workstation nftables
#!/usr/sbin/nft -f
flush ruleset
table inet filter {
chain input {
type filter hook input priority 0; policy drop
iifname lo accept
ct state established,related accept
# allow any incoming ICMP and ICMPv6
ip protocol icmp accept
ip6 nexthdr ipv6-icmp accept
# allow DHCPv6
udp dport 546 udp sport 547 accept
# allow incoming broadcast and multicast (e.g. NTP)
pkttype { broadcast,multicast} accept
chain forward {
type filter hook forward priority 0; policy drop
chain output {
type filter hook output priority 0; policy accept
# not sure if this is required but let's track all outgoing connections
ct state new accept
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment