Firewall Zones, the nftables Way

This server has two network interfaces: one faces the internet, the other sits on the management network. firewalld would call those zones. On a plain nftables box you build the same idea yourself: traffic is handled according to the interface it arrived on.

Right now it's wide open: someone set the input chain's policy to accept while debugging and never set it back, and the one rule there opens SSH on every interface, internet included. /root/case/assignment.env names the public interface, the management interface, the SSH port and the HTTPS port (all differ per session). Change /etc/nftables.conf, which is what loads at boot, so that:

1. SSH is reachable only from the management interface, not the public one;

2. the public interface accepts HTTPS and nothing else, with the input policy back to drop.

Grading evaluates your ruleset for a new connection on each interface and port, so any correct style passes: iifname on each rule, a chain per zone, or a verdict map. Test it with nft -c -f /etc/nftables.conf and load it with nft -f. The file reloads only its own table, so it won't disturb the lab's other rules.