nftables.conf (router advertisments are not processed)

#!/usr/sbin/nft -f

flush ruleset

define allow_ip4s = {
	192.168.12.18
}

define allow_ip6s = {
	2001:db8:0::/48
}

table inet filter {
	chain input {
		type filter hook input priority 0; policy drop;
		ct state established,related accept
		ct state invalid drop
		tcp dport 80 ip saddr $allow_ip4s accept
		tcp dport 22 accept
	}
	chain forward {
		type filter hook forward priority 0; policy drop;
	}
	chain output {
		type filter hook output priority 0; policy accept;
	}
}

table ip nat {
        chain prerouting {
                type nat hook prerouting priority -100; policy accept;
        }

        chain postrouting {
                type nat hook postrouting priority 100; policy accept;
                oifname "enp0s3" masquerade
        }
}

table ip6 filter {
	chain input {
		type filter hook input priority 0; policy drop;
		ct state established,related accept

	    iifname lo accept

		icmpv6 type {echo-request,nd-neighbor-solicit,nd-router-solicit,mld-listener-query,nd-neighbor-advert,nd-router-advert} accept

		tcp dport 80 ip6 saddr $allow_ip6s accept
	}
}