Vorlage:Input-output.conf

 flush ruleset
 table inet filter {
         chain input {
                  type filter hook input priority filter; policy drop;
                 ct state established,related accept
                 ct state new iif "lo" accept
                 ct state new iif $DMZDEV ip saddr $DMZ tcp dport 22 accept
 	     	 ct state new iif $LANDEV ip saddr $LAN tcp dport 22 accept
 	  	 ct state new iif "SERVERDEV" ip saddr $SERVER tcp dport 22 accept
 	 	 ct state new iif "WANDEV" ip saddr $HOST tcp dport 22 accept
                 ct state new icmp type echo-request accept 
                 log prefix " --nftables-drop-input-- "
          }
 
          chain output {
                 type filter hook output priority filter; policy drop;
                 ct state established,related accept
                 ct state new oif "lo" accept
                 ct state new accept
                 log prefix " --nftables-drop-output-- "
          }
 }