standard netfilter tables script for bootup on Arch : /etc/nftables.conf

nftables.conf

table inet firewall {
    chain incoming {
        type filter hook input priority 0;

        # bad tcp -> avoid network scanning:
        tcp flags & (fin|syn) == (fin|syn)                      drop
        tcp flags & (syn|rst) == (syn|rst)                      drop
        tcp flags & (fin|syn|rst|psh|ack|urg) < (fin)           drop # == 0 would be better, not supported yet.
        tcp flags & (fin|syn|rst|psh|ack|urg) == (fin|psh|urg)  drop

        # no ping floods:
        ip protocol icmp limit rate 10/second accept
        ip protocol icmp drop

        # established connections are trusted
        ct state {established, related} accept
        ct state invalid drop

        # loopback and private network are trusted
        iifname lo accept

        iif eth0 tcp dport 80                   counter accept          # http/https
        iif eth0 tcp dport 443                  counter accept          # http/https

        # everything else is untrusted
        log prefix "REJECT: " counter reject
    }
}