Wireguard auf Linux einrichten

# sudo pivpn -d

#!/usr/sbin/nft -f

flush ruleset

define pub_iface = "eth0"  
define wg_port = 57820

table inet drop-bad-ct-states {
	chain prerouting {
		type filter hook prerouting priority -150; policy accept;
		# Drop packets in "invalid" connection-tracking state 
		ct state invalid drop
		# Drop tcp packets for new connections that aren't syn packets 
		tcp flags & (fin|syn|rst|ack) != syn ct state new counter drop
		# Drop XMAS packets.
		tcp flags & (fin|syn|rst|psh|ack|urg) == fin|syn|rst|psh|ack|urg counter drop
		# Drop NULL packets.
		tcp flags & (fin|syn|rst|psh|ack|urg) == 0x0 counter drop
		# Drop new connections over rate limit
		ct state new limit rate over 1/second burst 10 packets drop
		}
}

table inet filter {
	chain input {
		type filter hook input priority 0; policy drop;
		# Accept any localhost traffic
		iif lo accept

		# Accept any wireguard traffic
		iifname "wg0" accept  

		# Accept traffic originated from own server
		ct state established,related accept

		# Accepted ICMP types
		ip protocol icmp icmp type {time-exceeded, parameter-problem, destination-unreachable } accept

		# Accept common local TCP services on public interface
		iif $pub_iface tcp dport { ssh } ct state new accept

		# Accepted UDP ports on public interface 
		iif $pub_iface udp dport { isakmp, ipsec-nat-t, $wg_port } accept 
		iif $pub_iface ip protocol esp accept 

		# allow IPsec VPN networks
		meta ipsec exists accept

		# Accept neighbour discovery otherwise IPv6 connectivity breaks.
		ip6 nexthdr icmpv6 icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept

		# Log and count dropped traffic
		# log prefix "[nftables]Denied: " counter drop 
		# only count dropped traffic
		counter drop
	}
	chain forward {
		type filter hook forward priority 0;
	}
	chain output {
		type filter hook output priority 0;
	}
}