ansible-edda/playbooks/filesystem/valkyrie/etc/nftables.conf.j2

#!/usr/sbin/nft -f

flush ruleset

table inet filter {
        chain input {
                type filter hook input priority 0;

                # Accept any localhost traffic.
                iif lo accept;

                # Accept traffic originated from us.
                ct state established,related accept;

                # Allow ICMP packets.
                # Note that for IPv6 nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert are needed to not break connectivity.
                ip6 nexthdr icmpv6 icmpv6 type { echo-request, destination-unreachable, packet-too-big, time-exceeded, parameter-problem, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } accept;
                ip protocol icmp icmp type { echo-request, destination-unreachable, router-advertisement, time-exceeded, parameter-problem } accept;

                # Drop invalid connections.
                ct state invalid drop;

                # Accept HTTP, HTTPS, SSH.
                tcp dport { 80, 443, {{ ansible_port }} } ct state new accept;

                # Accept WireGuard.
                iif {{ ethx }} udp dport {{ vpn_wg0_port }} accept;

                # Count and drop any other traffic.
                counter drop;
        }
        chain forward {
                type filter hook forward priority 0;
        }
        chain output {
                type filter hook output priority 0;
        }
}