Межсетевой экран nftables

sudo apt update
sudo apt install nftables
sudo nft list ruleset

sudo cp /etc/nftables.conf /etc/nftables.conf.bak

sudo nano /etc/nftables.conf

#!/usr/sbin/nft -f

flush ruleset

table inet filter {
  chain input {
    type filter hook input priority filter; policy drop;

    ct state established,related accept
    ct state invalid drop
    iif "lo" accept
    meta l4proto { icmp, ipv6-icmp } accept

    tcp dport 22 accept
    tcp dport { 80, 443 } accept
  }

  chain forward {
    type filter hook forward priority filter; policy drop;
  }

  chain output {
    type filter hook output priority filter; policy accept;
  }
}

sudo nft -c -f /etc/nftables.conf

sudo nft -f /etc/nftables.conf
sudo systemctl enable --now nftables
sudo nft list ruleset

ip saddr 203.0.113.10 tcp dport 22 accept