#!/usr/sbin/nft -f

flush ruleset
table inet filter {

set trusted_ips {
    type ipv4_addr;
    flags interval;

elements = {
        193.123.36.107,      # oracle 1
        129.151.237.120,     # oracle 2
        65.21.73.59,         # pbs2.mlp.pp.ua
        168.119.210.104,     # Gia2
        144.76.74.132,       # BKU
        65.108.104.32,       # MTIR
        78.46.64.247,        # Gia1
        95.217.60.246,       # Him, Diol
        142.132.149.175,     # Kovi
        95.217.46.123,       # DTZ_PBS

    }
}


	chain input {
                type filter hook input priority filter; policy drop;

                # 🔒 Защита от пустых TCP-пакетов (NULL scan и др.)
                tcp flags & (fin|syn|rst|psh|ack|urg) == 0 counter drop comment "Drop malformed TCP packets"

                # ❌ Отбросить недопустимые соединения
                ct state invalid counter drop comment "Drop invalid connections"

                # ✅ Разрешить установленные и связанные соединения
                ct state established,related accept comment "Accept established and related connections"

                # ✅ Разрешить loopback
                iifname "lo" counter accept comment "Accept loopback interface"

				# ✅ Доступ с доверенных IP:
				ip saddr @trusted_ips  tcp dport { 22, 8006 } counter accept comment "My IP"
				ip saddr @trusted_ips  ip protocol icmp accept comment "My IP"
        }

}



table ip6 filter {
    chain input {
        type filter hook input priority filter; policy drop;
    }

    chain forward {
        type filter hook forward priority filter; policy drop;
    }

    chain output {
        type filter hook output priority filter; policy accept;
    }
}