If you ever need to work with the older Ubuntu 16.04, you'll see that the default nftables.conf file in the /etc directory already has the beginnings of a basic nft firewall configuration:

#!/usr/sbin/nft -f 
flush ruleset 
table inet filter { 
 chain input { 
 type filter hook input priority 0; 
 iif lo accept 
 ct state established,related accept 
 # tcp dport { 22, 80, 443 } ct state new accept 
 ip6 nexthdr icmpv6 icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept 

 counter drop 
 } 
} 

We'll look at how to work with this in just a bit.