flush ruleset

table inet nat {
	chain postrouting {
		type nat hook postrouting priority srcnat; policy accept;
		oifname "enx00e04c2e4828" ip saddr 10.50.0.0/24 counter packets 0 bytes 0 masquerade
	}
}
table inet filter {
	chain input {
		type filter hook input priority filter; policy drop;
		iif "lo" accept
		ct state invalid drop
		ct state { established, related } accept
		ip saddr 10.50.0.0/24 udp dport 53 accept
		ip saddr 10.50.0.0/24 tcp dport 53 accept
                ip saddr 192.168.33.0/24 udp dport 53 accept
                ip saddr 192.168.33.0/24 tcp dport 53 accept
                ip saddr 172.22.0.0/16 udp dport 53 accept
                ip saddr 172.22.0.0/16 tcp dport 53 accept
		ip protocol icmp accept
		ip6 nexthdr ipv6-icmp accept
                ip saddr 192.168.33.0/24 tcp dport 2222 ct state new accept
                iifname "wg0" tcp dport 2222 ct state new accept
		iifname "wg0" tcp dport 8080 ct state new accept
		iifname "wg0" tcp dport 3000 ct state new accept
                iifname "wg0" tcp dport { 3001, 8002 } ct state new accept
                iifname "wg0" tcp dport 3300 ct state new accept
		udp dport 52220 accept
		udp sport 67 udp dport 68 accept
		ip saddr 192.168.33.0/24 tcp dport 57385 ct state new limit rate 15/minute burst 5 packets counter packets 5 bytes 300 accept
		ip saddr 192.168.33.0/24 tcp dport 8000 ct state new counter packets 0 bytes 0 accept
		tcp dport 57385 ct state new limit rate 30/minute burst 20 packets counter packets 472 bytes 28056 accept
		tcp dport { 443, 9080 } ct state new accept
		ct state new tcp dport 52220 accept
                ct state new tcp dport 52690 accept
		tcp dport 64738 ct state new accept
		udp dport 64738 accept
                tcp dport 1965 ct state new accept
                tcp dport 70 ct state new accept
		counter packets 5683 bytes 896562 drop
		ip saddr { 10.50.0.0/24, 192.168.33.0/24 } tcp dport { 5055, 8502 } ct state new accept
		ip saddr { 10.50.0.0/24, 192.168.33.0/24 } tcp dport { 3100, 9090, 9095, 9096, 9100, 9516 } ct state new accept
                ip saddr 192.168.33.0/24 tcp dport 3300 ct state new accept
		tcp dport 5355 drop
		udp dport 5355 drop
		ip saddr != { 10.50.0.0/24, 192.168.33.0/24 } tcp dport 8000 drop
	}

	chain forward {
		type filter hook forward priority filter; policy drop;
		ct state { established, related } accept
		iifname "wg0" oifname "enx00e04c2e4828" counter packets 0 bytes 0 accept
		iifname "wg0" accept
		iifname "enx00e04c2e4828" oifname "wg0" accept
		iif "enx00e04c2e4828" oifname "br-*" accept
		iifname "br-*" oif "enx00e04c2e4828" accept
                iifname "br-*" oifname "wg0" accept
	}

	chain output {
		type filter hook output priority filter; policy accept;
	}
}
table ip nat {
	chain DOCKER {
		ip daddr 10.50.0.1 iifname != "br-07462fa2c80e" tcp dport 8080 counter packets 0 bytes 0 dnat to 172.18.0.2:8080
		ip daddr 127.0.0.1 iifname != "br-454eb7778b0a" tcp dport 8081 counter packets 0 bytes 0 dnat to 172.19.0.2:8080
		iifname != "br-3d1818651f84" tcp dport 5055 counter packets 0 bytes 0 dnat to 172.26.0.3:5055
		iifname != "br-3d1818651f84" tcp dport 8502 counter packets 0 bytes 0 dnat to 172.26.0.3:8502
		ip daddr 127.0.0.1 iifname != "br-ed53bc5d2155" tcp dport 9081 counter packets 0 bytes 0 dnat to 172.20.0.2:80
		ip daddr 127.0.0.1 iifname != "br-de49ada7ecfc" tcp dport 9091 counter packets 0 bytes 0 dnat to 172.21.0.4:80
		ip daddr 127.0.0.1 iifname != "br-7ad976d6055e" tcp dport 9001 counter packets 0 bytes 0 dnat to 172.25.0.2:9001
		iifname != "br-0a3c12139db8" tcp dport 8000 counter packets 0 bytes 0 dnat to 172.23.0.4:8000
		ip daddr 127.0.0.1 iifname != "br-bebca6296b94" tcp dport 3101 counter packets 0 bytes 0 dnat to 172.24.0.2:3000
		ip daddr 127.0.0.1 iifname != "br-bebca6296b94" tcp dport 3103 counter packets 0 bytes 0 dnat to 172.24.0.2:3003
	}

	chain PREROUTING {
		type nat hook prerouting priority dstnat; policy accept;
		fib daddr type local counter packets 22703 bytes 1612319 jump DOCKER
	}

	chain OUTPUT {
		type nat hook output priority dstnat; policy accept;
		ip daddr != 127.0.0.0/8 fib daddr type local counter packets 0 bytes 0 jump DOCKER
	}

	chain POSTROUTING {
		type nat hook postrouting priority srcnat; policy accept;
		ip saddr 172.23.0.0/16 oifname != "br-0a3c12139db8" counter packets 0 bytes 0 masquerade
		ip saddr 172.17.0.0/16 oifname != "docker0" counter packets 0 bytes 0 masquerade
		ip saddr 172.21.0.0/16 oifname != "br-de49ada7ecfc" counter packets 0 bytes 0 masquerade
		ip saddr 172.26.0.0/16 oifname != "br-3d1818651f84" counter packets 3 bytes 180 masquerade
		ip saddr 172.22.0.0/16 oifname != "br-2fd0bcdb4679" counter packets 0 bytes 0 masquerade
		ip saddr 172.18.0.0/16 oifname != "br-07462fa2c80e" counter packets 0 bytes 0 masquerade
		ip saddr 172.20.0.0/16 oifname != "br-ed53bc5d2155" counter packets 0 bytes 0 masquerade
		ip saddr 172.24.0.0/16 oifname != "br-bebca6296b94" counter packets 0 bytes 0 masquerade
		ip saddr 172.25.0.0/16 oifname != "br-7ad976d6055e" counter packets 0 bytes 0 masquerade
		ip saddr 172.19.0.0/16 oifname != "br-454eb7778b0a" counter packets 0 bytes 0 masquerade
	}
}
table ip filter {
	chain DOCKER {
		ip daddr 172.24.0.2 iifname != "br-bebca6296b94" oifname "br-bebca6296b94" tcp dport 3003 counter packets 0 bytes 0 accept
		ip daddr 172.24.0.2 iifname != "br-bebca6296b94" oifname "br-bebca6296b94" tcp dport 3000 counter packets 0 bytes 0 accept
		ip daddr 172.23.0.4 iifname != "br-0a3c12139db8" oifname "br-0a3c12139db8" tcp dport 8000 counter packets 0 bytes 0 accept
		ip daddr 172.25.0.2 iifname != "br-7ad976d6055e" oifname "br-7ad976d6055e" tcp dport 9001 counter packets 0 bytes 0 accept
		ip daddr 172.21.0.4 iifname != "br-de49ada7ecfc" oifname "br-de49ada7ecfc" tcp dport 80 counter packets 0 bytes 0 accept
		ip daddr 172.20.0.2 iifname != "br-ed53bc5d2155" oifname "br-ed53bc5d2155" tcp dport 80 counter packets 0 bytes 0 accept
		ip daddr 172.26.0.3 iifname != "br-3d1818651f84" oifname "br-3d1818651f84" tcp dport 8502 counter packets 0 bytes 0 accept
		ip daddr 172.26.0.3 iifname != "br-3d1818651f84" oifname "br-3d1818651f84" tcp dport 5055 counter packets 0 bytes 0 accept
		ip daddr 172.19.0.2 iifname != "br-454eb7778b0a" oifname "br-454eb7778b0a" tcp dport 8080 counter packets 0 bytes 0 accept
		ip daddr 172.18.0.2 iifname != "br-07462fa2c80e" oifname "br-07462fa2c80e" tcp dport 8080 counter packets 0 bytes 0 accept
		iifname != "br-454eb7778b0a" oifname "br-454eb7778b0a" counter packets 0 bytes 0 drop
		iifname != "br-7ad976d6055e" oifname "br-7ad976d6055e" counter packets 0 bytes 0 drop
		iifname != "br-bebca6296b94" oifname "br-bebca6296b94" counter packets 0 bytes 0 drop
		iifname != "br-ed53bc5d2155" oifname "br-ed53bc5d2155" counter packets 0 bytes 0 drop
		iifname != "br-07462fa2c80e" oifname "br-07462fa2c80e" counter packets 0 bytes 0 drop
		iifname != "br-2fd0bcdb4679" oifname "br-2fd0bcdb4679" counter packets 0 bytes 0 drop
		iifname != "br-3d1818651f84" oifname "br-3d1818651f84" counter packets 0 bytes 0 drop
		iifname != "br-de49ada7ecfc" oifname "br-de49ada7ecfc" counter packets 0 bytes 0 drop
		iifname != "docker0" oifname "docker0" counter packets 0 bytes 0 drop
		iifname != "br-0a3c12139db8" oifname "br-0a3c12139db8" counter packets 0 bytes 0 drop
	}

	chain DOCKER-FORWARD {
		counter packets 400 bytes 2261453 jump DOCKER-CT
		counter packets 143 bytes 153471 jump DOCKER-INTERNAL
		counter packets 143 bytes 153471 jump DOCKER-BRIDGE
		iifname "br-454eb7778b0a" counter packets 0 bytes 0 accept
		iifname "br-7ad976d6055e" counter packets 0 bytes 0 accept
		iifname "br-bebca6296b94" counter packets 0 bytes 0 accept
		iifname "br-ed53bc5d2155" counter packets 0 bytes 0 accept
		iifname "br-07462fa2c80e" counter packets 0 bytes 0 accept
		iifname "br-2fd0bcdb4679" counter packets 0 bytes 0 accept
		iifname "br-3d1818651f84" counter packets 143 bytes 153471 accept
		iifname "br-de49ada7ecfc" counter packets 0 bytes 0 accept
		iifname "docker0" counter packets 0 bytes 0 accept
		iifname "br-0a3c12139db8" counter packets 0 bytes 0 accept
	}

	chain DOCKER-BRIDGE {
		oifname "br-454eb7778b0a" counter packets 0 bytes 0 jump DOCKER
		oifname "br-7ad976d6055e" counter packets 0 bytes 0 jump DOCKER
		oifname "br-bebca6296b94" counter packets 0 bytes 0 jump DOCKER
		oifname "br-ed53bc5d2155" counter packets 0 bytes 0 jump DOCKER
		oifname "br-07462fa2c80e" counter packets 0 bytes 0 jump DOCKER
		oifname "br-2fd0bcdb4679" counter packets 0 bytes 0 jump DOCKER
		oifname "br-3d1818651f84" counter packets 0 bytes 0 jump DOCKER
		oifname "br-de49ada7ecfc" counter packets 0 bytes 0 jump DOCKER
		oifname "docker0" counter packets 0 bytes 0 jump DOCKER
		oifname "br-0a3c12139db8" counter packets 0 bytes 0 jump DOCKER
	}

	chain DOCKER-CT {
		oifname "br-454eb7778b0a" ct state related,established counter packets 0 bytes 0 accept
		oifname "br-7ad976d6055e" ct state related,established counter packets 0 bytes 0 accept
		oifname "br-bebca6296b94" ct state related,established counter packets 0 bytes 0 accept
		oifname "br-ed53bc5d2155" ct state related,established counter packets 0 bytes 0 accept
		oifname "br-07462fa2c80e" ct state related,established counter packets 0 bytes 0 accept
		oifname "br-2fd0bcdb4679" ct state related,established counter packets 0 bytes 0 accept
		oifname "br-3d1818651f84" ct state related,established counter packets 257 bytes 2107982 accept
		oifname "br-de49ada7ecfc" ct state related,established counter packets 0 bytes 0 accept
		oifname "docker0" ct state related,established counter packets 0 bytes 0 accept
		oifname "br-0a3c12139db8" ct state related,established counter packets 0 bytes 0 accept
	}

	chain DOCKER-INTERNAL {
	}

	chain FORWARD {
		type filter hook forward priority filter; policy accept;
		counter packets 400 bytes 2261453 jump DOCKER-USER
		counter packets 400 bytes 2261453 jump DOCKER-FORWARD
	}

	chain DOCKER-USER {
	}
}
table ip6 nat {
	chain DOCKER {
	}

	chain PREROUTING {
		type nat hook prerouting priority dstnat; policy accept;
		fib daddr type local counter packets 0 bytes 0 jump DOCKER
	}

	chain OUTPUT {
		type nat hook output priority dstnat; policy accept;
		ip6 daddr != ::1 fib daddr type local counter packets 0 bytes 0 jump DOCKER
	}
}
table ip6 filter {
	chain DOCKER {
	}

	chain DOCKER-FORWARD {
		counter packets 0 bytes 0 jump DOCKER-CT
		counter packets 0 bytes 0 jump DOCKER-INTERNAL
		counter packets 0 bytes 0 jump DOCKER-BRIDGE
	}

	chain DOCKER-BRIDGE {
	}

	chain DOCKER-CT {
	}

	chain DOCKER-INTERNAL {
	}

	chain FORWARD {
		type filter hook forward priority filter; policy accept;
		counter packets 0 bytes 0 jump DOCKER-USER
		counter packets 0 bytes 0 jump DOCKER-FORWARD
	}

	chain DOCKER-USER {
	}
}
table ip raw {
	chain PREROUTING {
		type filter hook prerouting priority raw; policy accept;
		ip daddr 172.21.0.2 iifname != "br-de49ada7ecfc" counter packets 0 bytes 0 drop
		ip daddr 172.26.0.2 iifname != "br-3d1818651f84" counter packets 0 bytes 0 drop
		ip daddr 172.21.0.3 iifname != "br-de49ada7ecfc" counter packets 0 bytes 0 drop
		ip daddr 172.26.0.3 iifname != "br-3d1818651f84" counter packets 0 bytes 0 drop
		ip daddr 172.18.0.2 iifname != "br-07462fa2c80e" counter packets 0 bytes 0 drop
		ip daddr 172.19.0.2 iifname != "br-454eb7778b0a" counter packets 0 bytes 0 drop
		ip daddr 172.20.0.2 iifname != "br-ed53bc5d2155" counter packets 0 bytes 0 drop
		ip daddr 172.21.0.4 iifname != "br-de49ada7ecfc" counter packets 0 bytes 0 drop
		ip daddr 172.25.0.2 iifname != "br-7ad976d6055e" counter packets 0 bytes 0 drop
		ip daddr 127.0.0.1 iifname != "lo" tcp dport 8081 counter packets 0 bytes 0 drop
		ip daddr 127.0.0.1 iifname != "lo" tcp dport 9081 counter packets 0 bytes 0 drop
		ip daddr 127.0.0.1 iifname != "lo" tcp dport 9091 counter packets 0 bytes 0 drop
		ip daddr 127.0.0.1 iifname != "lo" tcp dport 9001 counter packets 0 bytes 0 drop
		ip daddr 172.23.0.2 iifname != "br-0a3c12139db8" counter packets 0 bytes 0 drop
		ip daddr 172.23.0.3 iifname != "br-0a3c12139db8" counter packets 0 bytes 0 drop
		ip daddr 172.23.0.4 iifname != "br-0a3c12139db8" counter packets 0 bytes 0 drop
		ip daddr 172.24.0.2 iifname != "br-bebca6296b94" counter packets 0 bytes 0 drop
		ip daddr 127.0.0.1 iifname != "lo" tcp dport 3101 counter packets 0 bytes 0 drop
		ip daddr 127.0.0.1 iifname != "lo" tcp dport 3103 counter packets 0 bytes 0 drop
		ip daddr 127.0.0.1 iifname != "lo" tcp dport 8000 ip saddr != 192.168.33.0/24 counter packets 0 bytes 0 drop
	}
}
table inet f2b-table {
	set addr-set-sshd {
		type ipv4_addr
		flags interval
	}

	chain f2b-chain {
		type filter hook input priority filter - 1; policy accept;
		meta l4proto tcp ip saddr @addr-set-sshd reject with icmp port-unreachable
	}
}