#!/usr/bin/nft -f
# vim:set ts=2 sw=2 et:

# IPv4/IPv6 default-deny firewall ruleset.

destroy table inet filter
table inet filter {
  chain input {
    type filter hook input priority filter
    policy drop

    ct state invalid drop comment "early drop of invalid connections"
    ct state {established, related} accept comment "allow tracked connections"
    iif lo accept comment "allow from loopback"
    meta l4proto { icmp, icmpv6 } accept comment "allow icmp"
    meta pkttype multicast udp dport 5353 accept comment "allow mDNS discovery"

    pkttype host limit rate 5/second counter reject with icmpx type admin-prohibited
    counter
  }
  chain forward {
    type filter hook forward priority filter
    policy drop

  }
}