Basic NFTables Ruleset

#!/usr/sbin/nft -f

flush ruleset

table ip filter4 {
	set blacklist4 {
		type ipv4_addr
		flags interval
		auto-merge
		elements = { xx.yy.zz/22 }
	}

	chain input {
		type filter hook input priority filter; policy drop;
		iif "lo" ip saddr 127.0.0.0/8 ip daddr 127.0.0.0/8 counter accept
		ip saddr @blacklist4 counter reject
		ct state established,related counter accept
		icmp type echo-request limit rate 1/second counter accept
		tcp dport 22 ct state new limit rate 4/minute counter accept
		counter reject
	}

	chain output {
		type filter hook output priority filter; policy drop;
		oif "lo" ip saddr 127.0.0.0/8 ip daddr 127.0.0.0/8 counter accept
		ip daddr @blacklist4 counter reject
		ip protocol tcp counter accept
		ip protocol udp counter accept
		ip protocol icmp counter accept
		counter reject
	}
}
table ip6 filter6 {
	set blacklist6 {
		type ipv6_addr
		flags interval
		auto-merge
		elements = { xxxx:yyyy::/32 }
	}

	chain input {
		type filter hook input priority filter; policy drop;
		iif "lo" ip6 saddr ::1 ip6 daddr ::1 counter accept
		ip6 saddr @blacklist6 counter reject
		ct state established,related counter accept
		meta l4proto ipv6-icmp accept
		icmpv6 type echo-request limit rate 1/second counter accept
		tcp dport 22 ct state new limit rate 4/minute counter accept
		counter reject
	}

	chain output {
		type filter hook output priority filter; policy drop;
		oif "lo" ip6 saddr ::1 ip6 daddr ::1 counter accept
		ip6 nexthdr tcp counter accept
		ip6 nexthdr udp counter accept
		ip6 nexthdr ipv6-icmp counter accept
		counter reject
	}
}

nft add element filter4 blacklist4 "{ 185.60.216.0/22 }";