Forum Debian Users Gang

# root ~> egrep -v '^#|^$' /etc/nftables/nftables.rules  
flush ruleset
table inet filter {
    set systemdns {
        type ipv4_addr
        elements = { 1.0.0.1, 1.1.1.1,
                 8.8.4.4, 8.8.8.8,
                 208.67.220.220, 208.67.222.222 }
    }
    set youtubeslow {
        type ipv4_addr
        flags interval
        elements = { 62.252.170.140, 62.252.170.141,
                 62.252.170.142, 62.252.170.143,
                 62.252.170.144, 62.252.170.145,
                 62.252.170.146, 62.252.170.147,
                 62.253.3.0/24, 173.194.55.0/24,
                 206.111.0.0/16 }
    }
    set systemdns6 {
        type ipv6_addr
        elements = { 2001:4860:4860::8844,
                 2001:4860:4860::8888,
                 2620:0:ccc::2,
                 2620:0:ccd::2 }
    }
       set outallow { 
            type ipv4_addr
             flags interval
            elements = { 217.70.184.38 , 185.52.170.0/24, 34.255.157.6 , 52.208.16.85, 52.84.198.0/24, 63.239.232.208/28, 63.239.232.224/30 }
           }
       set outallow6 { 
             type ipv6_addr
             flags interval
            elements = { 2a02:26f0:d8::6851:3c3b, 2a02:26f0:d8::6851:3c28, 2600:1409:6800::1728:c648, 2600:1409:6800::1728:c611, }
           }
    chain input {
        type filter hook input priority 0; policy drop;
        ct state established,related accept
        iif "lo" accept
        ip saddr 192.168.1.21 tcp dport 1716 counter accept
        ip saddr 192.168.1.21 udp dport 1716 counter accept
        ip6 saddr fe80::/10 tcp dport 1716 counter accept
        ip6 saddr fe80::/10 udp dport 1716 counter accept
        ip6 nexthdr ipv6-icmp counter accept
        ip protocol icmp icmp type { destination-unreachable, router-advertisement, router-solicitation, time-exceeded, parameter-problem } accept
    }
    chain forward {
        type filter hook forward priority 0; policy drop;
                ct state established,related accept
                oifname "net" counter accept 
    }
    chain output {
        type filter hook output priority 200; policy drop;
        ct state established,related accept
        oifname "lo" accept
        ip daddr @systemdns counter accept
        ip daddr @youtubeslow counter reject
        ip6 daddr @systemdns6 counter accept
        ip daddr @outallow counter accept
        ip6 daddr @outallow6 counter accept
        ip protocol icmp counter accept
        ip6 nexthdr ipv6-icmp counter accept
        cgroup 1 counter accept
        cgroup 2 counter accept
        cgroup 3 counter accept
        cgroup 4 counter accept
        cgroup 5 counter accept
        cgroup 6 counter accept
        cgroup 7 counter accept
        cgroup 8 counter accept
        cgroup 9 counter accept
        cgroup 11 counter accept
               ct state new log prefix "OUTPUT Zablokowany: " group 0 queue-threshold 20 reject 
           reject
               }
}
table ip nat {
    chain prerouting {
        type nat hook prerouting priority 0; policy accept;
    }
    chain postrouting {
        type nat hook postrouting priority 100; policy accept;
        oifname "net" counter masquerade
    }
}