#!/usr/sbin/nft -f
flush ruleset
table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;
        # ==================== BASE ====================
        iif lo accept
        ct state invalid drop
        ct state established,related accept
        # ==================== ANTI-SCAN TCP ====================
        tcp flags & (fin|syn|rst|ack) == 0 drop            # NULL scan
        tcp flags & (fin|syn|rst|ack) == fin drop          # FIN scan seul
        tcp flags & (fin|syn|rst|ack) == syn|fin drop      # SYN+FIN
        tcp flags & (fin|syn|rst|ack) == syn|rst drop      # SYN+RST
        tcp flags & (fin|syn|rst|ack) == fin|psh|urg drop  # XMAS scan
        # ==================== ICMPv4 ====================
        ip protocol icmp icmp type echo-request limit rate 5/second burst 5 packets accept
        ip protocol icmp icmp type {echo-reply, destination-unreachable, time-exceeded, parameter-problem} accept
        # ==================== ICMPv6 (statique uniquement) ====================
        ip6 nexthdr icmpv6 icmpv6 type echo-request limit rate 5/second burst 5 packets accept
        ip6 nexthdr icmpv6 icmpv6 type {
            destination-unreachable,
            packet-too-big,
            time-exceeded,
            parameter-problem,
            echo-reply,
            nd-neighbor-solicit,
            nd-neighbor-advert,
            mld-listener-query,
            mld-listener-report,
            mld2-listener-report
        } accept
        # ==================== SSH ====================
        tcp dport 22 ct state new limit rate 5/minute burst 10 packets accept
    }
    chain forward {
        type filter hook forward priority 0; policy drop;
    }
    chain output {
        type filter hook output priority 0; policy accept;
    }
}
