guest_forge.nft RawHistoryFolder

1table inet ermite_runner
2delete table inet ermite_runner
3table inet ermite_runner {
4	set blocked_v4 {
5		type ipv4_addr
6		flags interval
7		elements = { 0.0.0.0/8, 10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.0.0.0/24, 192.0.2.0/24, 192.168.0.0/16, 198.18.0.0/15, 198.51.100.0/24, 203.0.113.0/24, 224.0.0.0/4, 240.0.0.0/4 }
8	}
9	chain input {
10		type filter hook input priority filter; policy accept;
11		iifname "ertap*" meta nfproto ipv6 drop
12		iifname "erbr*" meta nfproto ipv6 drop
13		ip daddr 10.200.0.1 udp dport 53 iifname != "ertap0" drop
14		ip daddr 10.200.0.1 tcp dport 53 iifname != "ertap0" drop
15		iifname "ertap0" ip saddr 10.200.0.2 ip daddr 10.200.0.1 udp dport 53 accept
16		iifname "ertap0" ip saddr 10.200.0.2 ip daddr 10.200.0.1 tcp dport 53 accept
17		iifname "ertap0" ip saddr 10.200.0.2 ip daddr 10.200.0.1 tcp dport 8088 accept
18		iifname "ertap0" drop
19		iifname "ertap*" drop
20		iifname "erbr*" drop
21	}
22	chain forward {
23		type filter hook forward priority filter; policy accept;
24		iifname "ertap*" meta nfproto ipv6 drop
25		iifname "erbr*" meta nfproto ipv6 drop
26		iifname "ertap0" ip saddr != 10.200.0.2 drop
27		iifname "ertap0" ip daddr @blocked_v4 drop
28		iifname != { "ertap*", "erbr*" } oifname { "ertap*", "erbr*" } ct state established,related accept
29		oifname "ertap*" drop
30		oifname "erbr*" drop
31		iifname "ertap0" accept
32		iifname "ertap*" drop
33		iifname "erbr*" drop
34	}
35	chain postrouting {
36		type nat hook postrouting priority srcnat; policy accept;
37		ip saddr 10.200.0.2 oifname != "ertap0" masquerade
38	}
39}