NFTables 现代内核防火墙配置生成器

#!/usr/sbin/nft -f
flush ruleset

table inet firewall {
  chain inbound {
    type filter hook input priority 0; policy drop;

    # Allow established and related connections
    ct state established,related accept
    iif "lo" accept
    tcp dport { 22 } accept comment "SSH Access"
    tcp dport { 80, 443 } accept comment "Web HTTP/HTTPS"
    icmp accept comment "Allow Ping"
  }
}