DNAT port forward to internal host nftables

Rate-limit new connections nft add rule inet filter input tcp dport 22 ct state new limit rate 10/minute accept Watch ruleset changes live nft monitor ruleset Atomic backup and restore of ruleset nft list ruleset > /etc/nftables.conf && nft -f /etc/nftables.conf Hardware flowtable offload nft add flowtable inet filter ft '{ hook ingress priority 0 ; devices = { eth0, eth1 } ; }' && nft add rule inet filter forward ct state established flow add @ft Create input chain with drop policy nft add chain inet filter input '{ type filter hook input priority 0 ; policy drop ; }'