Void Linux – nftables

xbps-install -Suv nftables runit-nftables

cat << EOF >/etc/nftables.conf
#!/usr/sbin/nft -f

flush ruleset

table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;

        iif lo accept 
            comment "accept any localhost traffic"

        ct state established,related accept
        
        ct state invalid drop 
            comment "drop invalid connections";

        icmpv6 type { nd-neighbor-solicit, nd-router-advert, 
            nd-neighbor-advert } accept
            comment "accept neighbour discovery otherwise IPv6 connectivity breaks"

        udp sport 5678 udp dport 5678 ip daddr 255.255.255.255 accept 
            comment "Mikrotik Neighbor Discovery Protocol"

        tcp dport 22 accept

        #tcp dport { 80, 443 } accept

        # drop before log

        # DHCP
        #udp sport 68 udp dport 67 drop
        udp sport 68 udp dport 67 ip daddr 255.255.255.255 drop

        # SMB, SMB2, CIFS, NetBIOS, WINS
        udp dport { 137, 138 } drop
        tcp dport { 139, 445 } drop

        # High ports
        tcp dport 1024-65535 drop
        udp dport 1024-65535 drop

        log prefix "[nft:filter:input] drop: " counter drop 
            comment "logging of denied input"
    }
}
EOF

ln -s /etc/sv/nftables /var/service

nft list ruleset