Basic nftables config

basic_nftables

#! /usr/bin/nft -f

### localhost
define LOCALHOST = { 127.0.0.1 }
define LOCALHOST6 = { ::1 }

table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;
        ct state invalid counter drop comment "early drop of invalid packets"
        ip protocol 47 counter drop comment "drop all GRE packets"
        ct state {established, related} accept comment "accept all connections related to connections made by us"
        iif lo accept comment "accept loopback"
        iif != lo ip daddr 127.0.0.1/8 counter drop comment "drop connections to loopback not coming from loopback"
        iif != lo ip6 daddr ::1/128 counter drop comment "drop connections to loopback not coming from loopback"
        ip saddr != $LOCALHOST tcp dport 25 drop comment "drop all SMTP"
        ip6 saddr != $LOCALHOST6 tcp dport 25 drop comment "drop all SMTP"
        ip protocol icmp counter accept comment "accept all ICMP types"
        ip6 nexthdr icmpv6 counter accept comment "accept all ICMP types"
        counter comment "count dropped packets"
    }

    chain forward {
        type filter hook forward priority 0; policy accept;
    }

    chain output {
        type filter hook output priority 0; policy accept;
    }
}