config upload

server/nftables.conf

@@ -0,0 +1,34 @@
+#!/usr/sbin/nft -f
+
+flush ruleset
+
+table inet filter {
+	chain input {
+		type filter hook input priority filter;
+	}
+	chain forward {
+		type filter hook forward priority filter;
+	}
+	chain output {
+		type filter hook output priority filter;
+	}
+}
+
+table ip filter {
+	chain forward {
+		type filter hook forward priority 0; policy drop;
+
+		# Allow existing connections
+		iifname "ens4" oifname "ens5" ct state { established, related } accept
+
+		# Allow new outgoing traffic
+		iifname "ens5" oifname "ens4" accept
+	}
+}
+
+table ip nat {
+	chain postrouting {
+		type nat hook postrouting priority 100;
+		oifname "ens4" masquerade
+	}
+}