IPv6 Firewall Router

Simple IPv4 Firwall

table ip filter {
	chain input {
		type filter hook input priority filter; policy drop;
		ct state established,related accept
		ct state new iif "ens4" tcp dport 22 accept
		ct state new iif "ens5" accept
		ct state new iifname "lo" accept
		log prefix "--nftables-drop-input--"
	}

	chain forward {
		type filter hook forward priority filter; policy drop;
		ct state established,related accept
		ct state new iif "ens5" oif "ens4" accept
		log prefix "--nftables-drop-forward--"
	}

	chain output {
		type filter hook output priority filter; policy drop;
		ct state established,related accept
		ct state new accept
		log prefix "--nftables-drop-output--"
	}
}
table ip nat {
	chain postrouting {
		type nat hook postrouting priority srcnat; policy accept;
		oif "ens4" masquerade
	}
}

Simple Dual Stack Firewall

table inet filter {
	chain input {
		type filter hook input priority filter; policy drop;
		ct state established,related accept
		ct state new iif "ens3" tcp dport 22 accept
		ct state new iif "ens4" accept
		ct state new iifname "lo" accept
		ip6 nexthdr ipv6-icmp accept
		log prefix "--nftables-drop-input--"
	}

	chain forward {
		type filter hook forward priority filter; policy drop;
		ct state established,related accept
		ct state new iif "ens4" oif "ens3" accept
		log prefix "--nftables-drop-forward--"
	}

	chain output {
		type filter hook output priority filter; policy drop;
		ct state established,related accept
		ip6 nexthdr ipv6-icmp accept
		ct state new accept
		log prefix "--nftables-drop-output--"
	}
}
table ip nat {
	chain postrouting {
		type nat hook postrouting priority srcnat; policy accept;
		oif "ens3" masquerade
	}
}