---

#!/usr/sbin/nft -f

flush ruleset

table ip nat {
    chain prerouting {
        type nat hook prerouting priority -100; policy accept;
        iifname "enp0s9" tcp dport 80 dnat to 192.168.12.10
    }
    chain postrouting {
        type nat hook postrouting priority 100; policy accept;
        oifname "enp0s8" masquerade
    }
}

table inet filter {
    chain input {
        type filter hook input priority filter; policy drop;
        iif lo accept
        ct state established,related accept
        icmp type { echo-request, echo-reply, destination-unreachable, redirect, time-exceeded } accept
        tcp dport 22 ip saddr 192.168.12.0/24 accept
        log prefix "INPUT DROP: " drop
    }
    chain forward {
        type filter hook forward priority filter; policy drop;
        ct state established,related accept
        ip saddr 192.168.12.0/24 accept
        log prefix "FORWARD DROP: " drop
    }
    chain output {
        type filter hook output priority filter; policy accept;
    }
}