#!/usr/sbin/nft -f

flush ruleset

table inet filter {
	chain input {
		type filter hook input priority filter;
	}
	chain forward {
		type filter hook forward priority filter;
	}
	chain output {
		type filter hook output priority filter;
	}
}

table ip filter {
	chain forward {
		type filter hook forward priority 0; policy drop;

		# Allow existing connections
		iifname "ens4" oifname "ens5" ct state { established, related } accept

		# Allow new outgoing traffic
		iifname "ens5" oifname "ens4" accept
	}
}

table ip nat {
	chain postrouting {
		type nat hook postrouting priority 100;
		oifname "ens4" masquerade
	}
}