Nftables.sh

cat > /etc/nftables.conf <<EOF
#!/usr/sbin/nft -f
flush ruleset

table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;

        # Anti-spoof loopback
        iif != lo ip  saddr 127.0.0.0/8 drop
        iif != lo ip6 saddr ::1          drop
        iif lo accept

        # Drop invalid
        ct state invalid drop

        # Drop malformed TCP
        tcp flags & (fin|syn|rst|psh|ack|urg) == 0x0  drop
        tcp flags & (fin|syn)                == (fin|syn) drop
        tcp flags & (syn|rst)                == (syn|rst) drop

        # Allow established/related
        ct state established,related accept

        # SSH — one IP, rate limited
        ip saddr 10.12.0.50 tcp dport 22 \
            ct state new \
            limit rate 3/minute burst 5 packets \
            accept

        # ICMP echo — one IP only
        ip saddr 10.12.0.50 icmp type echo-request \
            limit rate 5/second \
            accept

        # Log and drop everything else
        limit rate 5/minute \
            log prefix "[nft-drop] " flags all
        drop
    }

    chain forward {
        type filter hook forward priority 0; policy drop;
    }

    chain output {
        type filter hook output priority 0; policy accept;
    }
}
EOF

Kernel-level hardening to complement nftables

Add to /etc/sysctl.d/99-network-hardening.conf

net.ipv4.tcp_syncookies = 1 # SYN flood protection
net.ipv4.conf.all.rp_filter = 1 # Reverse path filtering
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.icmp_ignore_bogus_error_responses = 1