#!/usr/sbin/nft -f

define SVC_TCP = { 80, 443, 853, 8443 }
define SVC_UDP = { 123, 443, 853, 8443 }

destroy table inet raw
destroy table inet filter

table inet raw {
    chain prerouting {
        type filter hook prerouting priority raw; policy accept;

        iif "lo" notrack
        tcp dport $SVC_TCP notrack
        udp dport $SVC_UDP notrack
    }

    chain output {
        type filter hook output priority raw; policy accept;

        oif "lo" notrack
        tcp sport $SVC_TCP notrack
        udp sport $SVC_UDP notrack
    }
}

table inet filter {
    chain input {
        type filter hook input priority filter; policy drop;

        iif "lo" accept

        ct state established,related accept
        ct state invalid drop

        tcp dport $SVC_TCP accept
        udp dport $SVC_UDP accept

        icmp type echo-request limit rate 20/second accept
        icmp type { destination-unreachable, time-exceeded, parameter-problem } accept

        icmpv6 type echo-request limit rate 20/second accept
        icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem } accept
        icmpv6 type { nd-neighbor-solicit, nd-neighbor-advert, nd-router-advert } ip6 hoplimit 255 accept
    }

    chain forward {
        type filter hook forward priority filter; policy drop;
    }

    chain output {
        type filter hook output priority filter; policy accept;
    }
}