Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Simple workstation nftables
#!/usr/sbin/nft -f
flush ruleset
table inet filter {
chain input {
type filter hook input priority 0; policy drop
iifname lo accept
ct state established,related accept
# allow any incoming ICMP and ICMPv6
ip protocol icmp accept
ip6 nexthdr ipv6-icmp accept
# allow DHCPv6
udp dport 546 udp sport 547 accept
# allow incoming broadcast and multicast (e.g. NTP)
pkttype { broadcast,multicast} accept
log
}
chain forward {
type filter hook forward priority 0; policy drop
log
}
chain output {
type filter hook output priority 0; policy accept
# not sure if this is required but let's track all outgoing connections
ct state new accept
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment