And my nftable.conf
`
define docker_v4 = 172.17.0.0/16
define docker_v6 = fe80::/48
table inet filter {
chain input {
type filter hook input priority 0;
ct state {established, related} accept
# early drop of invalid connections
ct state invalid drop
# allow from loopback
iifname lo accept
# allow icmp
ip protocol icmp accept
ip6 nexthdr icmpv6 accept
# allow ssh
tcp dport ssh accept
# avoid brute force on ssh:
tcp dport ssh ct state new limit rate 15/minute accept
# allow http(s)
tcp dport { http, https } accept
# allow matrix
tcp dport 8448 accept
# allow smtps
udp dport 3000 accept
tcp dport 465 accept
tcp dport 587 accept
tcp dport 993 accept
tcp dport 4190 accept
# allow iperf3
tcp dport 5201 accept
udp dport 5201 accept
# Bedrock
tcp dport 19132 accept
tcp dport 19133 accept
udp dport 19132 accept
udp dport 19133 accept
# Eco
tcp dport 3000 accept
udp dport 3000 accept
tcp dport 3001 accept
udp dport 3001 accept
# TURN
tcp dport 3478 accept
udp dport 3478 accept
tcp dport 5349 accept
udp dport 5349 accept
udp dport 49152-65535 accept
# everything else
reject with icmpx type port-unreachable
}
chain forward {
type filter hook forward priority security; policy drop;
mark 1 accept
}
chain output {
type filter hook output priority 0;
}
}
table ip nat {
chain prerouting {
type nat hook prerouting priority 0
}
chain postrouting {
type nat hook postrouting priority 0
oif eth0 counter masquerade
}
}
table ip filter {
chain DOCKER-USER {
mark set 1
}
}
`