#!/usr/sbin/nft -f
flush ruleset

table inet filter {
  chain input {
    type filter hook input priority 0;
    policy {{ firewall_nftables_policy_input }};

    iif lo accept
    ct state established,related accept
{% if firewall_nftables_allow_icmp %}
    ip protocol icmp accept
{% if firewall_nftables_allow_ipv6 %}
    ip6 nexthdr icmpv6 accept
{% endif %}
{% endif %}
{% for rule in firewall_nftables_allowed_tcp_in %}
    tcp dport {{ rule.dport }} ip saddr {{ rule.src }} accept
{% endfor %}
{% for rule in firewall_nftables_allowed_udp_in %}
    udp dport {{ rule.dport }} ip saddr {{ rule.src }} accept
{% endfor %}
  }

  chain forward {
    type filter hook forward priority 0;
    policy {{ firewall_nftables_policy_forward }};
  }

  chain output {
    type filter hook output priority 0;
    policy {{ firewall_nftables_policy_output }};
  }
}