Or if nft is too complicated (firewalld) then do ufw.