workstation/roles/debian/files/nftables.conf

#!/usr/sbin/nft -f

flush ruleset

table inet filter {
	chain input {
		type filter hook input priority filter; policy accept;

		# Accept any localhost and libvirt traffic.
		iif "lo" accept
		iifname "virbr0" accept

		# Accept traffic originated from us.
		ct state established,related accept

		# Open ports for public services.
		tcp dport 22 ct state new accept  # SSH

		# ICMPv6 packets which must not be dropped, see https://tools.ietf.org/html/rfc4890#section-4.4.1
		icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, echo-request, echo-reply, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, 148, 149 } accept
		ip6 saddr fe80::/10 icmpv6 type { mld-listener-query, mld-listener-report, mld-listener-done, mld2-listener-report, 151, 152, 153 } accept

		# Count and drop any other traffic.
		counter drop
	}

	chain forward {
		type filter hook forward priority filter; policy accept;
	}

	chain output {
		type filter hook output priority filter; policy accept;
	}
}
table ip nat {
	chain postrouting {
		type nat hook postrouting priority srcnat; policy accept;

		# Masquerade NAT traffic (useful for VMs).
		masquerade
	}
}