#!/usr/sbin/nft -f

flush ruleset

table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;
        iif lo accept
        ct state established,related accept
        # Log and drop invalid packets
        ct state invalid log prefix "INVALID: " level warn drop
        # Log and accept SSH
        tcp dport 22 ct state new log prefix "SSH: " level info accept
        # Allow web traffic (no logging to reduce volume)
        #tcp dport { 80, 443 } accept
        # Log everything else that reaches the end (default drop)
        log prefix "INPUT DROP: " level warn
    }

    chain forward {
        type filter hook forward priority 0; policy drop;

        log prefix "FORWARD DROP: " level warn
    }

    chain output {
        type filter hook output priority 0; policy accept;
        # dns request
        udp dport 53 log prefix "DNS:" level info
        # accept local connection
        ip daddr 192.168.122.1 counter accept
        ip daddr 192.168.0.253 counter accept
        ip daddr 192.168.0.254 counter accept
        # counter output packets 
        counter comment "Count accepted packets"
        # not logging established
        ct state established,related accept
        # Log and accept output packets
        log prefix "OUTPUT:" level info flags skuid accept
    }
}