role_nftables/templates/nftables.conf.j2

#!/usr/sbin/nft -f
# {{ ansible_managed }}

flush ruleset

table inet filter {
  chain input {
    type filter hook input priority 0;

    # accept any localhost traffic
    iif lo accept

    # accept traffic originated from us
    ct state established,related accept

    # accept neighbour discovery otherwise IPv6 connectivity breaks.
    ip6 nexthdr icmpv6 icmpv6 type {nd-neighbor-solicit,  nd-router-advert, nd-neighbor-advert} accept

{% if nftables_rules | length > 0 %}
    # include specific rules
    include "/srv/nftables/rules.conf"
{% endif %}

    # count and drop any other traffic
    counter drop
  }
}

{% if nftables_tables | length > 0 %}
# include more tables
include "/srv/nftables/tables.conf"
{% endif %}