IP-Adressbereich mit IPTables sperren ( Ubuntu 22.04 )

#!/usr/sbin/nft -f

flush ruleset

define pub_iface = "eth0"  
define wg_port = 57820

table inet drop-bad-ct-states {
	chain prerouting {
		type filter hook prerouting priority -150; policy accept;
		# drop packets in "invalid" connection-tracking state 
		ct state invalid drop
		# drop tcp packets for new connections that aren't syn packets 
		tcp flags & (fin|syn|rst|ack) != syn ct state new counter drop
		# drop XMAS packets.
		tcp flags & (fin|syn|rst|psh|ack|urg) == fin|syn|rst|psh|ack|urg counter drop
		# drop NULL packets.
		tcp flags & (fin|syn|rst|psh|ack|urg) == 0x0 counter drop
		# drop new connections over rate limit
		ct state new limit rate over 1/second burst 10 packets drop
		}
}

table inet filter {
	chain input {
		type filter hook input priority 0; policy drop;
		# accept any localhost traffic
		iif lo accept

		# accept any wireguard traffic
		# iifname $wg_iface tcp dport http accept
		iifname "wg0" accept  

		# accept traffic originated from us
		ct state established,related accept

		# accepted ICMP types
		# ip protocol icmp icmp type {echo-request, echo-reply, time-exceeded, parameter-problem, destination-unreachable } accept
		ip protocol icmp icmp type {time-exceeded, parameter-problem, destination-unreachable } accept

		# accept common local TCP services on public interface
		iif $pub_iface tcp dport { ssh } ct state new accept

		# accepted UDP ports and ESP on public interface (VPN)
		iif $pub_iface udp dport { isakmp, ipsec-nat-t, $wg_port } accept 
		iif $pub_iface ip protocol esp accept 

		# allow IPsec VPN networks
		meta ipsec exists accept

		# accept neighbour discovery otherwise IPv6 connectivity breaks.
		ip6 nexthdr icmpv6 icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept

		# log and count dropped traffic
		# log prefix "[nftables]Denied: " counter drop 
		# only count dropped traffic
		counter drop
	}
	chain forward {
		type filter hook forward priority 0;
	}
	chain output {
		type filter hook output priority 0;
	}
} 

[DEFAULT]
banaction =             nftables-multiport
banaction_allports =    nftables-allports
chain =                 input
[recidive]
banaction =             nftables-allports