From 44bdd99900202917084d3c6b125496f26403bf1e Mon Sep 17 00:00:00 2001
From: billz <billzimmerman@gmail.com>
Date: Fri, 21 Mar 2025 06:53:28 -0700
Subject: [PATCH] Modify script to use nft instead of iptables

---
 firewall-rules.sh | 35 ++++++++++++++++++++++++++++++-----
 1 file changed, 30 insertions(+), 5 deletions(-)
 mode change 100644 => 100755 firewall-rules.sh

diff --git a/firewall-rules.sh b/firewall-rules.sh
old mode 100644
new mode 100755
index a9f423e..c25774a
--- a/firewall-rules.sh
+++ b/firewall-rules.sh
@@ -1,6 +1,31 @@
 #!/bin/bash
-iptables -I DOCKER-USER -i src_if -o dst_if -j ACCEPT
-iptables -t nat -C POSTROUTING -o eth0 -j MASQUERADE || iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
-iptables -C FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT || iptables -A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-iptables -C FORWARD -i wlan0 -o eth0 -j ACCEPT || iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT
-iptables-save
\ No newline at end of file
+set -e
+
+# Flush existing nftables rules
+nft flush ruleset
+
+# Apply new nftables rules
+nft add table inet filter
+
+# Define filter chains
+nft add chain inet filter input { type filter hook input priority 0 \; policy accept \; }
+nft add chain inet filter forward { type filter hook forward priority 0 \; policy accept \; }
+nft add chain inet filter output { type filter hook output priority 0 \; policy accept \; }
+
+# Allow established and related connections
+nft add rule inet filter forward ct state related,established accept
+
+# Allow forwarding between wlan0 and eth0
+nft add rule inet filter forward iifname "wlan0" oifname "eth0" accept
+nft add rule inet filter forward iifname "eth0" oifname "wlan0" accept
+
+# NAT table
+nft add table inet nat
+nft add chain inet nat prerouting { type nat hook prerouting priority 0 \; }
+nft add chain inet nat postrouting { type nat hook postrouting priority 100 \; }
+
+# Masquerade outgoing traffic on eth0
+nft add rule inet nat postrouting oifname "eth0" masquerade
+
+echo "nftables firewall rules applied successfully."
+