table inet nat {
	chain postrouting {
		type nat hook postrouting priority srcnat; policy accept;
		oifname "enx00e04c2e4828" ip saddr 10.50.0.0/24 counter packets 0 bytes 0 masquerade
	}
}
table inet filter {
	chain input {
		type filter hook input priority filter; policy drop;
		iif "lo" accept
		ct state invalid drop
		ct state { established, related } accept
		ip saddr 10.50.0.0/24 udp dport 53 accept
		ip saddr 10.50.0.0/24 tcp dport 53 accept
		ip saddr 192.168.33.0/24 udp dport 53 accept
		ip saddr 192.168.33.0/24 tcp dport 53 accept
		ip saddr 172.22.0.0/16 udp dport 53 accept
		ip saddr 172.22.0.0/16 tcp dport 53 accept
		ip protocol icmp accept
		ip6 nexthdr ipv6-icmp accept
		ip saddr 192.168.33.0/24 tcp dport 2222 ct state new accept
		iifname "wg0" tcp dport 2222 ct state new accept
		iifname "wg0" tcp dport 8080 ct state new accept
		iifname "wg0" tcp dport 3000 ct state new accept
		iifname "wg0" tcp dport { 3001, 8002 } ct state new accept
		iifname "wg0" tcp dport 3300 ct state new accept
		udp dport 52220 accept
		udp sport 67 udp dport 68 accept
		ip saddr 192.168.33.0/24 tcp dport 57385 ct state new limit rate 15/minute burst 5 packets counter packets 24 bytes 1440 accept
		ip saddr 192.168.33.0/24 tcp dport 8000 ct state new counter packets 0 bytes 0 accept
		tcp dport 57385 ct state new limit rate 30/minute burst 20 packets counter packets 7285 bytes 439500 accept
		tcp dport { 443, 9080 } ct state new accept
		ct state new tcp dport 52220 accept
		ct state new tcp dport 52690 accept
		tcp dport 64738 ct state new accept
		udp dport 64738 accept
		tcp dport 1965 ct state new accept
		tcp dport 70 ct state new accept
		counter packets 100331 bytes 24311938 drop
		ip saddr { 10.50.0.0/24, 192.168.33.0/24 } tcp dport { 5055, 8502 } ct state new accept
		ip saddr { 10.50.0.0/24, 192.168.33.0/24 } tcp dport { 3100, 9090, 9095, 9096, 9100, 9516 } ct state new accept
		ip saddr 192.168.33.0/24 tcp dport 3300 ct state new accept
		tcp dport 5355 drop
		udp dport 5355 drop
		ip saddr != { 10.50.0.0/24, 192.168.33.0/24 } tcp dport 8000 drop
	}

	chain forward {
		type filter hook forward priority filter; policy drop;
		ct state { established, related } accept
		iifname "wg0" oifname "enx00e04c2e4828" counter packets 0 bytes 0 accept
		iifname "wg0" accept
		iifname "enx00e04c2e4828" oifname "wg0" accept
		iif "enx00e04c2e4828" oifname "br-*" accept
		iifname "br-*" oif "enx00e04c2e4828" accept
		iifname "br-*" oifname "wg0" accept
	}

	chain output {
		type filter hook output priority filter; policy accept;
	}
}
# Warning: table ip nat is managed by iptables-nft, do not touch!
table ip nat {
	chain DOCKER {
		ip daddr 10.50.0.1 iifname != "br-07462fa2c80e" tcp dport 8080 counter packets 4430 bytes 265800 dnat to 172.18.0.2:8080
		ip daddr 127.0.0.1 iifname != "br-454eb7778b0a" tcp dport 8081 counter packets 0 bytes 0 dnat to 172.19.0.2:8080
		iifname != "br-3d1818651f84" tcp dport 5055 counter packets 0 bytes 0 dnat to 172.26.0.3:5055
		iifname != "br-3d1818651f84" tcp dport 8502 counter packets 0 bytes 0 dnat to 172.26.0.3:8502
		ip daddr 127.0.0.1 iifname != "br-ed53bc5d2155" tcp dport 9081 counter packets 0 bytes 0 dnat to 172.20.0.2:80
		ip daddr 127.0.0.1 iifname != "br-de49ada7ecfc" tcp dport 9091 counter packets 0 bytes 0 dnat to 172.21.0.4:80
		ip daddr 127.0.0.1 iifname != "br-7ad976d6055e" tcp dport 9001 counter packets 0 bytes 0 dnat to 172.25.0.2:9001
		iifname != "br-0a3c12139db8" tcp dport 8000 counter packets 0 bytes 0 dnat to 172.23.0.4:8000
		ip daddr 127.0.0.1 iifname != "br-bebca6296b94" tcp dport 3101 counter packets 0 bytes 0 dnat to 172.24.0.2:3000
		ip daddr 127.0.0.1 iifname != "br-bebca6296b94" tcp dport 3103 counter packets 0 bytes 0 dnat to 172.24.0.2:3003
		iifname != "br-8f7fc81a0600" tcp dport 2222 counter packets 9 bytes 540 dnat to 172.30.0.2:22
		iifname != "br-8f7fc81a0600" tcp dport 3300 counter packets 318 bytes 19080 dnat to 172.30.0.2:3000
		ip daddr 10.50.0.1 iifname != "br-e2d8a9eac20e" tcp dport 3001 counter packets 19 bytes 1138 dnat to 172.22.0.2:3001
	}

	chain PREROUTING {
		type nat hook prerouting priority dstnat; policy accept;
		fib daddr type local counter packets 249517 bytes 32928887 jump DOCKER
	}

	chain OUTPUT {
		type nat hook output priority dstnat; policy accept;
		ip daddr != 127.0.0.0/8 fib daddr type local counter packets 5296 bytes 317760 jump DOCKER
	}

	chain POSTROUTING {
		type nat hook postrouting priority srcnat; policy accept;
		ip saddr 172.23.0.0/16 oifname != "br-0a3c12139db8" counter packets 0 bytes 0 masquerade
		ip saddr 172.17.0.0/16 oifname != "docker0" counter packets 0 bytes 0 masquerade
		ip saddr 172.21.0.0/16 oifname != "br-de49ada7ecfc" counter packets 6 bytes 360 masquerade
		ip saddr 172.26.0.0/16 oifname != "br-3d1818651f84" counter packets 3 bytes 180 masquerade
		ip saddr 172.22.0.0/16 oifname != "br-2fd0bcdb4679" counter packets 32880 bytes 2067095 masquerade
		ip saddr 172.18.0.0/16 oifname != "br-07462fa2c80e" counter packets 287 bytes 17220 masquerade
		ip saddr 172.20.0.0/16 oifname != "br-ed53bc5d2155" counter packets 2 bytes 120 masquerade
		ip saddr 172.24.0.0/16 oifname != "br-bebca6296b94" counter packets 3 bytes 180 masquerade
		ip saddr 172.25.0.0/16 oifname != "br-7ad976d6055e" counter packets 0 bytes 0 masquerade
		ip saddr 172.19.0.0/16 oifname != "br-454eb7778b0a" counter packets 0 bytes 0 masquerade
	}
}
table ip filter {
	chain DOCKER {
		ip daddr 172.22.0.2 iifname != "br-e2d8a9eac20e" oifname "br-e2d8a9eac20e" tcp dport 3001 counter packets 0 bytes 0 accept
		ip daddr 172.30.0.2 iifname != "br-8f7fc81a0600" oifname "br-8f7fc81a0600" tcp dport 3000 counter packets 0 bytes 0 accept
		ip daddr 172.30.0.2 iifname != "br-8f7fc81a0600" oifname "br-8f7fc81a0600" tcp dport 22 counter packets 0 bytes 0 accept
		ip daddr 172.24.0.2 iifname != "br-bebca6296b94" oifname "br-bebca6296b94" tcp dport 3003 counter packets 0 bytes 0 accept
		ip daddr 172.24.0.2 iifname != "br-bebca6296b94" oifname "br-bebca6296b94" tcp dport 3000 counter packets 0 bytes 0 accept
		ip daddr 172.23.0.4 iifname != "br-0a3c12139db8" oifname "br-0a3c12139db8" tcp dport 8000 counter packets 0 bytes 0 accept
		ip daddr 172.25.0.2 iifname != "br-7ad976d6055e" oifname "br-7ad976d6055e" tcp dport 9001 counter packets 0 bytes 0 accept
		ip daddr 172.21.0.4 iifname != "br-de49ada7ecfc" oifname "br-de49ada7ecfc" tcp dport 80 counter packets 0 bytes 0 accept
		ip daddr 172.20.0.2 iifname != "br-ed53bc5d2155" oifname "br-ed53bc5d2155" tcp dport 80 counter packets 0 bytes 0 accept
		ip daddr 172.26.0.3 iifname != "br-3d1818651f84" oifname "br-3d1818651f84" tcp dport 8502 counter packets 0 bytes 0 accept
		ip daddr 172.26.0.3 iifname != "br-3d1818651f84" oifname "br-3d1818651f84" tcp dport 5055 counter packets 0 bytes 0 accept
		ip daddr 172.19.0.2 iifname != "br-454eb7778b0a" oifname "br-454eb7778b0a" tcp dport 8080 counter packets 0 bytes 0 accept
		ip daddr 172.18.0.2 iifname != "br-07462fa2c80e" oifname "br-07462fa2c80e" tcp dport 8080 counter packets 0 bytes 0 accept
		iifname != "br-454eb7778b0a" oifname "br-454eb7778b0a" counter packets 0 bytes 0 drop
		iifname != "br-7ad976d6055e" oifname "br-7ad976d6055e" counter packets 0 bytes 0 drop
		iifname != "br-bebca6296b94" oifname "br-bebca6296b94" counter packets 0 bytes 0 drop
		iifname != "br-ed53bc5d2155" oifname "br-ed53bc5d2155" counter packets 0 bytes 0 drop
		iifname != "br-07462fa2c80e" oifname "br-07462fa2c80e" counter packets 0 bytes 0 drop
		iifname != "br-2fd0bcdb4679" oifname "br-2fd0bcdb4679" counter packets 0 bytes 0 drop
		iifname != "br-3d1818651f84" oifname "br-3d1818651f84" counter packets 0 bytes 0 drop
		iifname != "br-de49ada7ecfc" oifname "br-de49ada7ecfc" counter packets 0 bytes 0 drop
		iifname != "docker0" oifname "docker0" counter packets 0 bytes 0 drop
		iifname != "br-0a3c12139db8" oifname "br-0a3c12139db8" counter packets 0 bytes 0 drop
	}

	chain DOCKER-FORWARD {
		counter packets 1321965 bytes 698498753 jump DOCKER-CT
		counter packets 1307852 bytes 661726331 jump DOCKER-INTERNAL
		counter packets 1307852 bytes 661726331 jump DOCKER-BRIDGE
		iifname "br-454eb7778b0a" counter packets 0 bytes 0 accept
		iifname "br-7ad976d6055e" counter packets 0 bytes 0 accept
		iifname "br-bebca6296b94" counter packets 40 bytes 8333 accept
		iifname "br-ed53bc5d2155" counter packets 37 bytes 4045 accept
		iifname "br-07462fa2c80e" counter packets 7631 bytes 1205643 accept
		iifname "br-2fd0bcdb4679" counter packets 0 bytes 0 accept
		iifname "br-3d1818651f84" counter packets 143 bytes 153471 accept
		iifname "br-de49ada7ecfc" counter packets 2928 bytes 163686 accept
		iifname "docker0" counter packets 0 bytes 0 accept
		iifname "br-0a3c12139db8" counter packets 0 bytes 0 accept
	}

	chain DOCKER-BRIDGE {
		oifname "br-454eb7778b0a" counter packets 0 bytes 0 jump DOCKER
		oifname "br-7ad976d6055e" counter packets 0 bytes 0 jump DOCKER
		oifname "br-bebca6296b94" counter packets 0 bytes 0 jump DOCKER
		oifname "br-ed53bc5d2155" counter packets 0 bytes 0 jump DOCKER
		oifname "br-07462fa2c80e" counter packets 0 bytes 0 jump DOCKER
		oifname "br-2fd0bcdb4679" counter packets 0 bytes 0 jump DOCKER
		oifname "br-3d1818651f84" counter packets 0 bytes 0 jump DOCKER
		oifname "br-de49ada7ecfc" counter packets 0 bytes 0 jump DOCKER
		oifname "docker0" counter packets 0 bytes 0 jump DOCKER
		oifname "br-0a3c12139db8" counter packets 0 bytes 0 jump DOCKER
	}

	chain DOCKER-CT {
		oifname "br-454eb7778b0a" ct state established,related counter packets 0 bytes 0 accept
		oifname "br-7ad976d6055e" ct state established,related counter packets 0 bytes 0 accept
		oifname "br-bebca6296b94" ct state established,related counter packets 37 bytes 12496 accept
		oifname "br-ed53bc5d2155" ct state established,related counter packets 33 bytes 25191 accept
		oifname "br-07462fa2c80e" ct state established,related counter packets 9081 bytes 12474633 accept
		oifname "br-2fd0bcdb4679" ct state established,related counter packets 0 bytes 0 accept
		oifname "br-3d1818651f84" ct state established,related counter packets 257 bytes 2107982 accept
		oifname "br-de49ada7ecfc" ct state established,related counter packets 4705 bytes 22152120 accept
		oifname "docker0" ct state established,related counter packets 0 bytes 0 accept
		oifname "br-0a3c12139db8" ct state established,related counter packets 0 bytes 0 accept
	}

	chain DOCKER-INTERNAL {
	}

	chain FORWARD {
		type filter hook forward priority filter; policy accept;
		counter packets 1321965 bytes 698498753 jump DOCKER-USER
		counter packets 1321965 bytes 698498753 jump DOCKER-FORWARD
	}

	chain DOCKER-USER {
	}
}
table ip6 nat {
	chain DOCKER {
	}

	chain PREROUTING {
		type nat hook prerouting priority dstnat; policy accept;
		fib daddr type local counter packets 0 bytes 0 jump DOCKER
	}

	chain OUTPUT {
		type nat hook output priority dstnat; policy accept;
		ip6 daddr != ::1 fib daddr type local counter packets 0 bytes 0 jump DOCKER
	}
}
table ip6 filter {
	chain DOCKER {
	}

	chain DOCKER-FORWARD {
		counter packets 0 bytes 0 jump DOCKER-CT
		counter packets 0 bytes 0 jump DOCKER-INTERNAL
		counter packets 0 bytes 0 jump DOCKER-BRIDGE
	}

	chain DOCKER-BRIDGE {
	}

	chain DOCKER-CT {
	}

	chain DOCKER-INTERNAL {
	}

	chain FORWARD {
		type filter hook forward priority filter; policy accept;
		counter packets 0 bytes 0 jump DOCKER-USER
		counter packets 0 bytes 0 jump DOCKER-FORWARD
	}

	chain DOCKER-USER {
	}
}
table ip raw {
	chain PREROUTING {
		type filter hook prerouting priority raw; policy accept;
		ip daddr 172.21.0.2 iifname != "br-de49ada7ecfc" counter packets 0 bytes 0 drop
		ip daddr 172.26.0.2 iifname != "br-3d1818651f84" counter packets 0 bytes 0 drop
		ip daddr 172.21.0.3 iifname != "br-de49ada7ecfc" counter packets 0 bytes 0 drop
		ip daddr 172.26.0.3 iifname != "br-3d1818651f84" counter packets 0 bytes 0 drop
		ip daddr 172.18.0.2 iifname != "br-07462fa2c80e" counter packets 0 bytes 0 drop
		ip daddr 172.19.0.2 iifname != "br-454eb7778b0a" counter packets 0 bytes 0 drop
		ip daddr 172.20.0.2 iifname != "br-ed53bc5d2155" counter packets 0 bytes 0 drop
		ip daddr 172.21.0.4 iifname != "br-de49ada7ecfc" counter packets 0 bytes 0 drop
		ip daddr 172.25.0.2 iifname != "br-7ad976d6055e" counter packets 0 bytes 0 drop
		ip daddr 127.0.0.1 iifname != "lo" tcp dport 8081 counter packets 0 bytes 0 drop
		ip daddr 127.0.0.1 iifname != "lo" tcp dport 9081 counter packets 0 bytes 0 drop
		ip daddr 127.0.0.1 iifname != "lo" tcp dport 9091 counter packets 0 bytes 0 drop
		ip daddr 127.0.0.1 iifname != "lo" tcp dport 9001 counter packets 0 bytes 0 drop
		ip daddr 172.23.0.2 iifname != "br-0a3c12139db8" counter packets 0 bytes 0 drop
		ip daddr 172.23.0.3 iifname != "br-0a3c12139db8" counter packets 0 bytes 0 drop
		ip daddr 172.23.0.4 iifname != "br-0a3c12139db8" counter packets 0 bytes 0 drop
		ip daddr 172.24.0.2 iifname != "br-bebca6296b94" counter packets 0 bytes 0 drop
		ip daddr 127.0.0.1 iifname != "lo" tcp dport 3101 counter packets 0 bytes 0 drop
		ip daddr 127.0.0.1 iifname != "lo" tcp dport 3103 counter packets 0 bytes 0 drop
		ip daddr 127.0.0.1 iifname != "lo" tcp dport 8000 ip saddr != 192.168.33.0/24 counter packets 0 bytes 0 drop
		ip daddr 172.30.0.2 iifname != "br-8f7fc81a0600" counter packets 0 bytes 0 drop
	}
}
table inet f2b-table {
	set addr-set-sshd {
		type ipv4_addr
		flags interval
	}

	chain f2b-chain {
		type filter hook input priority filter - 1; policy accept;
		meta l4proto tcp ip saddr @addr-set-sshd reject with icmp port-unreachable
	}
}