example-router2.nft

#!/usr/sbin/nft -f

## Note: This example is default reject for forwarded traffic.
## You will need to whitelist required ports/IPs to allow traffic.

flush ruleset

define LAN_IPV4 = {
  172.16.0.0/24
}

define LAN_IPV6 = {
  2001:abcd:2222:100a::/64
}

define PRIVATE_IPV4 = {
  10.0.0.0/8,
  192.168.0.0/16,
  172.16.0.0/12
}

define PRIVATE_IPV6 = {
  fe80::/10,
  fd00::/8
}

table inet filter {
        chain input {
                type filter hook input priority 0; policy drop;
                ct state invalid counter drop comment "early drop of invalid packets"
                ct state {established, related} counter accept comment "accept all connections related to connections made by us"
                meta l4proto icmp icmp type echo-request limit rate over 10/second burst 4 packets drop comment "No ping floods"
                meta l4proto ipv6-icmp icmpv6 type echo-request limit rate over 10/second burst 4 packets drop comment "No ping floods"
                iif lo accept comment "accept loopback"
                iif != lo ip daddr 127.0.0.1/8 counter drop comment "drop connections to loopback not coming from loopback"
                iif != lo ip6 daddr ::1/128 counter drop comment "drop connections to loopback not coming from loopback"
                ip protocol icmp counter accept comment "accept all ICMP types"
                ip6 nexthdr icmpv6 counter accept comment "accept all ICMP types"

                # SSH
                tcp dport 22 accept

                # DNS for LAN
                tcp dport 53 ip saddr {$LAN_IPV4} accept
                udp dport 53 ip saddr {$LAN_IPV4} accept

                # DNS for LAN (IPv6)
                tcp dport 53 ip6 saddr {$LAN_IPV6} accept
                udp dport 53 ip6 saddr {$LAN_IPV6} accept

                # DHCP for LAN
                udp dport 67 ip saddr {$LAN_IPV4} accept
        }

        chain forward {
                type filter hook forward priority 0; policy reject;

                # HTTP / HTTPS ports
                tcp dport {80,443} accept

                # DNS
                tcp dport 53 accept
                udp dport 53 accept

                # SSH
                tcp dport 22 accept

                # RDP
                tcp dport 3389 accept
                udp dport 3389 accept

                # POP3 (TLS)
                tcp dport {995} accept

                # IMAP (TLS)
                tcp dport {993} accept

                # SMTP (TLS)
                tcp dport {465,587} accept
        }

        chain prerouting {
                type nat hook prerouting priority -101; policy accept;

                # RDP port forwarding example
                ip saddr 0.0.0.0/0 ip daddr 1.2.3.4 tcp dport 3389 dnat to 172.16.0.51:3389
                ip saddr 0.0.0.0/0 ip daddr 1.2.3.4 udp dport 3389 dnat to 172.16.0.51:3389
        }

        chain postrouting {
                type nat hook postrouting priority 101; policy accept;
               
                # NAT (Example 1)
                #ip saddr {$LAN_IPV4} oifname eth2 snat to 1.2.3.4 random
                
                # NAT (Example 2)
                #oifname eth2 masquerade
        }

        chain output {
                type filter hook output priority 0; policy accept;
        }
}