IPv6 Firewall Router

Simple IPv4 Firwall

table ip filter {
	chain input {
		type filter hook input priority filter; policy drop;
		ct state established,related accept
		ct state new iif "ens4" tcp dport 22 accept
		ct state new iif "ens5" accept
		ct state new iifname "lo" accept
		log prefix "--nftables-drop-input--"
	}

	chain forward {
		type filter hook forward priority filter; policy drop;
		ct state established,related accept
		ct state new iif "ens5" oif "ens4" accept
		log prefix "--nftables-drop-forward--"
	}

	chain output {
		type filter hook output priority filter; policy drop;
		ct state established,related accept
		ct state new accept
		log prefix "--nftables-drop-output--"
	}
}
table ip nat {
	chain postrouting {
		type nat hook postrouting priority srcnat; policy accept;
		oif "ens4" masquerade
	}
}
<pre>





<pre>
#!/usr/sbin/nft -f

define local_tcp_ports = { 22 }
define webserver = "2a02:24d8:71:2445::102"
define wandev = ens4
define landev = ens5
define transit_4 = "192.168.44.0/24"
define transit_6 = "2a02:24d8:71:2444::/64"
define lan_4 = 192.168.45.0/24
define lan_6 = "2a02:24d8:71:2445::/64"


flush ruleset
table inet filter {
    chain input {
        type filter hook input priority filter; policy drop;
        ct state established,related accept
        ct state new tcp dport $local_tcp_ports accept 
        ct state new iifname "lo" accept
        ct state new icmp type echo-request accept 
        ip6 nexthdr icmpv6 accept
        log prefix "--nftables-drop-input--"
    }
    chain forward {
        type filter hook forward priority filter; policy drop;
        ct state established,related accept
        ct state new iif $landev oif $wandev accept
        ct state new iif $wandev oif $landev ip6 daddr $webserver tcp dport 80  accept
        log prefix "--nftables-drop-forward--"
    }

    chain output {
        type filter hook output priority filter; policy drop;
        ct state established,related accept
        ip6 nexthdr icmpv6 accept
        ct state new  accept
        log prefix "--nftables-drop-output--"
    }
}

table ip nat {
	chain postrouting {
		type nat hook postrouting priority 100;
		oif ens4 masquerade
	 }
}