# /etc/nftables.conf - Mentalnet GNU/Linux firewall
# Loaded by /etc/init.d/S35nftables at boot. Edit and re-run:
#   nft -f /etc/nftables.conf

flush ruleset

table inet filter {
	chain input {
		type filter hook input priority 0; policy drop;

		# loopback
		iifname "lo" accept

		# established and related connections
		ct state established,related accept

		# DHCP client replies
		udp sport 67 udp dport 68 accept

		# ICMP (ping et al.)
		ip protocol icmp accept
		ip6 nexthdr icmpv6 accept

		# services: SSH, HTTP
		tcp dport 22 accept
		tcp dport 80 accept

		# log and reject everything else (rate-limited: goes to
		# syslog, not the TTY - see /etc/sysctl.conf)
		limit rate 1/minute log prefix "nft-drop: " counter
		counter reject with icmpx type port-unreachable
	}

	chain forward {
		type filter hook forward priority 0; policy accept;
	}

	chain output {
		type filter hook output priority 0; policy accept;
	}
}