nftables.conf

# Home router setup with following two sides:
#   - WAN:  DHCP provided from upstream (e.g. modem), only ping allowed
#   - LAN:  Static IP 192.168.150.1 on bridged LAN
#           ICMPv4 ping, DHCP, DNS, and SSH (on port 922) allowed
#
# See NFTables documentation for more details:
#   - https://wiki.nftables.org/wiki-nftables/index.php/Quick_reference-nftables_in_10_minutes
#   - https://wiki.nftables.org/wiki-nftables/index.php/Netfilter_hooks
#   - https://wiki.nftables.org/wiki-nftables/index.php/Ruleset_debug/tracing

### Useful commands ###
# Flush all rules:          nft flush ruleset
# List current ruleset:     nft list ruleset

# Remove any leftover rules
flush ruleset

define DEV_PRIVATE  = lan-bridge0
define DEV_WORLD    = wan-eth0
define NET_PRIVATE  = 192.168.150.0/24

table ip global {
    chain inbound_world {
        # Accept WAN-side pings but rate limited to 5 per sec
        icmp type echo-request limit rate 5/second accept

        # Allow SSH from the WAN network
        #
        # NOTE: Strongly suggest disabling WAN-side SSH entirely
        #       Unless you know what you're doing, this can be extremely dangerous
        #       if the WAN port is on the public internet.
        #       If you do know what you're doing, you'll probaly move SSH to
        #       a non-standard port and install a tool like failtoban.
        #tcp dport 22 accept
    }

    chain inbound_private {
        # Accept LAN-side pings but rate limited to 5 per sec
        icmp type echo-request limit rate 5/second accept

        # Allow DHCP, DNS and SSH (on port 922) from the private network
        ip protocol . th dport vmap { udp . 53 : accept, tcp . 53 : accept, udp . 67 : accept, tcp . 922 : accept }
    }

    chain inbound {
        type filter hook input priority 0; policy drop;

        # Allow traffic from established and related packets, drop invalid
        ct state vmap { established : accept, related : accept, invalid : drop }

        # Allow loopback traffic, anything else jump to chain for further evaluation
        iifname vmap { lo : accept, $DEV_WORLD : jump inbound_world, $DEV_PRIVATE : jump inbound_private }

        # Everything else dropped
    }

    chain forward {
        type filter hook forward priority 0; policy drop;

        # Allow traffic from established and related packets, drop invalid
        ct state vmap { established : accept, related : accept, invalid : drop }

        # Connections from the LAN to WAN allowed
        iifname $DEV_PRIVATE accept

        # Everything else dropped
    }

    chain postrouting {
        type nat hook postrouting priority 100; policy accept;

        # Masquerade private IP addresses (masqueraded src NAT)
        ip saddr $NET_PRIVATE oifname $DEV_WORLD masquerade
    }
}