---

#!/usr/sbin/nft -f

flush ruleset

table inet filter {
    chain input {
        type filter hook input priority filter; policy drop;
        iifname "lo" accept
        ct state established,related accept
        ip protocol icmp icmp type { echo-reply, destination-unreachable, redirect, echo-request, time-exceeded } accept
        ip saddr 192.168.12.0/24 ip protocol tcp dport 22 accept
        log prefix "INPUT DROP: " drop
    }
    chain forward {
        type filter hook forward priority filter; policy drop;
        ct state established,related accept
        ip saddr 192.168.12.0/24 accept
        log prefix "FORWARD DROP: " drop
    }
    chain output {
        type filter hook output priority filter; policy accept;
    }
}