#!/usr/sbin/nft -f

flush ruleset

table inet filter {
	chain input {
		type filter hook input priority filter;
		policy drop;

		# allow establihed,related
		ct state established,related accept

		# allow lo
		iif lo accept

		# Allow SSH
		tcp dport 22 accept

		# allow ping
		icmp type echo-request accept
		icmp type echo-reply accept


	}
	chain forward {
		type filter hook forward priority filter;
		policy drop;

		# allow establihed,related
		ct state established,related accept

		# allow http & https from WAN > DMZ
		ip saddr 0.0.0.0/0 ip daddr 192.168.10.10/32 tcp dport { 80,443 } accept

		# allow dns server
		ip saddr 0.0.0.0/0 ip daddr 192.168.10.10/24 udp dport 53 accept

		# allow htt & https from LAN to WAN
		ip saddr 192.168.20.0/24 ip daddr 0.0.0.0/0 tcp dport { 80,443 } accept

		# blokir telnet
		tcp dport 23 drop

		# allow tcp any from LAN to DMZ
		ip saddr 192.168.20.0/24 ip daddr 192.168.10.10/32 ip protocol tcp accept

		#  drop ping from WAN to LAN
		ip saddr 203.0.113.0/30 ip daddr 192.168.20.0/24 icmp type echo-request drop
		ip saddr 203.0.113.0/30 ip daddr 192.168.20.0/24 icmp type echo-reply drop

		# allow ping
		icmp type echo-request accept
		icmp type echo-reply accept

		# allow ssh
		ip saddr 192.168.10.0/24 ip daddr 203.0.113.0/30 tcp dport 22 accept

	}
	chain output {
		type filter hook output priority filter;
	}
}

