nftables-workstation.nft: set default policy to drop

[config/nftables.git] / nftables-workstation.nft

diff --git a/nftables-workstation.nft b/nftables-workstation.nft
index fd227f5..ecfb200 100644 (file)
--- a/nftables-workstation.nft
+++ b/nftables-workstation.nft
@@ -39,7 +39,8 @@ table inet filter {
     }
 
     chain input {
-        type filter hook input priority 0;
+        type filter hook input priority 0
+        policy drop
 
         ct state established,related accept
         ct state invalid drop
@@ -123,13 +124,17 @@ table inet filter {
     }
 
     chain forward {
-        type filter hook forward priority 0;
+        type filter hook forward priority 0
+        policy drop
+
         limit rate 3/minute burst 10 packets log prefix "[FORWARD]: "
         counter reject
     }
 
     chain output {
-        type filter hook output priority 0;
+        type filter hook output priority 0
+        policy drop
+
         counter accept
     }
 }