A minimal nftables ruleset for a single server

Goal

Expose only the ports a server is meant to serve, for IPv4 and IPv6 alike, in a ruleset that fits on one screen and reloads safely.

Prerequisites

Root access, the nft binary and a list of the ports the host serves.

Steps

1. Write /etc/nftables.conf following the structure of the nftables wiki's server example: flush ruleset, then one table inet filter so that a single rule set covers both address families.
2. Define chain input { type filter hook input priority 0; policy drop; ... } and, in order: ct state vmap { established : accept, related : accept, invalid : drop }, iifname lo accept, meta l4proto { icmp, ipv6-icmp } accept (ICMPv6 carries neighbour discovery; blocking it breaks IPv6, so the wiki example accepts at least the nd-* types), then tcp dport { 22, 80, 443 } accept.
3. Add chain forward { type filter hook forward priority 0; policy drop; } only if the host neither routes nor runs containers: nft(8) states that a packet is accepted only if no base chain drops it, so a dropping forward chain also blocks a container runtime's bridge traffic. Leave output undefined, which means accept.
4. While debugging, end the input chain with log prefix "nft-drop " counter drop.
5. Validate syntax without applying: nft -c -f /etc/nftables.conf.
6. Arm a rollback before loading: systemd-run --on-active=120 nft flush ruleset schedules a flush in two minutes (--on-active is documented in systemd-run(1)). Load with nft -f /etc/nftables.conf, confirm a new SSH session works, then stop the transient timer whose unit name systemd-run printed.
7. Inspect the live state with nft list ruleset; nft(8) states that this output may be used as input to nft -f, so it doubles as a backup.
8. Enable the distribution's nftables service so the file is loaded at boot.

Expected result

nft list ruleset shows exactly the intended chains; a port scan from outside shows only the listed ports; a reload with nft -f swaps the old ruleset for the new one in one operation (the wiki's "atomic rule replacement"), so there is no moment without rules, and existing connections keep matching ct state established.

Limits and test basis

The ruleset does not know which process listens on a port. Container runtimes insert their own tables and priorities; with bridge networking, traffic to published container ports is typically translated and forwarded rather than delivered locally, so it bypasses this input chain and meets the forward hook instead. Consult the runtime's firewall documentation before adding forward rules, and do not mix legacy iptables with nft. Syntax follows the cited wiki and manual; no throughput or security measurement is claimed.

Rollback to the previous ruleset, not to nothing

A scheduled flush ruleset leaves the host without any rules and removes tables other software relies on. Save the current state first and arm a restore instead:

nft list ruleset > /root/nft-before.conf
systemd-run --on-active=120 nft -f /root/nft-before.conf
nft -f /etc/nftables.conf

Confirm a new SSH session, then stop the transient timer. For the same reason, avoid flush ruleset in the configuration file on hosts running a container runtime: it deletes the runtime's ip nat and ip filter tables, and published ports stop working until the runtime restarts. Flush only your own table (table inet filter {} followed by flush table inet filter), which is still atomic for that table.