---

# Базовые правила (loopback и установленные соединения)
sudo nft add rule inet filter input iifname lo accept
sudo nft add rule inet filter input ct state established,related accept
sudo nft add rule inet filter forward ct state established,related accept
sudo nft add rule inet filter output oifname lo accept
sudo nft add rule inet filter output ct state established,related accept

# Разрешение ICMP (типы 0,3,5,8,11)
sudo nft add rule inet filter input ip protocol icmp icmp type { echo-reply, destination-unreachable, redirect, echo-request, time-exceeded } accept
sudo nft add rule inet filter output ip protocol icmp icmp type { echo-reply, destination-unreachable, redirect, echo-request, time-exceeded } accept