nftables rules

#!/usr/sbin/nft -f

flush ruleset

table inet filter {
    chain input {
        type filter hook input priority 0;

        # established/related connections
        ct state established,related accept

        # loopback interface
        iifname lo accept

        # open tcp/udp port 53 for dns
        tcp dport {53} accept
        udp dport {53} accept

        # icmp
        ip protocol icmp   accept
        ip6 nexthdr icmpv6 accept
    }
    chain forward {
        type filter hook forward priority 0;

        # established/related connections
        ct state established,related accept

        # icmp
        ip protocol icmp   accept
        ip6 nexthdr icmpv6 accept
    }
    chain output {
        type filter hook output priority 0;
    }
}

table ip nat {
    chain prerouting {
        type nat hook prerouting priority 0; policy accept;
    }

    chain postrouting {
        type nat hook postrouting priority 100; policy accept;
        oifname "eth_wan" ip saddr 10.0.0.0 masquerade
    }
}