nftables 案例

table inet filter {
    chain input {
        type filter hook input priority 0;
        policy drop;

        iif lo accept
        ct state established,related accept

        tcp dport 22 accept
#(可选)        tcp dport {80,443} accept
    }

    chain forward {
        policy drop;
    }

    chain output {
        policy accept;
    }
}

table inet filter {
    chain input {
        type filter hook input priority 0;
        policy drop;

        ct state established,related accept
        iif lo accept

        tcp dport 22 ct state new limit rate 5/minute accept
    }
}

set ssh_whitelist {
    type ipv4_addr
    elements = { 1.1.1.1 }
}

tcp dport 22 ip saddr @ssh_whitelist accept

table ip nat {
    chain prerouting {
        type nat hook prerouting priority -100;

        tcp dport 80 dnat to 127.0.0.1:8080
    }
}

set blacklist {
    type ipv4_addr
    flags timeout
}