table inet ermite_runner
delete table inet ermite_runner
table inet ermite_runner {
	set blocked_v4 {
		type ipv4_addr
		flags interval
		elements = { 0.0.0.0/8, 10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.0.0.0/24, 192.0.2.0/24, 192.168.0.0/16, 198.18.0.0/15, 198.51.100.0/24, 203.0.113.0/24, 224.0.0.0/4, 240.0.0.0/4 }
	}
	chain input {
		type filter hook input priority filter; policy accept;
		iifname "ertap*" meta nfproto ipv6 drop
		iifname "erbr*" meta nfproto ipv6 drop
		ip daddr 10.200.0.1 udp dport 53 iifname != "ertap0" drop
		ip daddr 10.200.0.1 tcp dport 53 iifname != "ertap0" drop
		iifname "ertap0" ip saddr 10.200.0.2 ip daddr 10.200.0.1 udp dport 53 accept
		iifname "ertap0" ip saddr 10.200.0.2 ip daddr 10.200.0.1 tcp dport 53 accept
		iifname "ertap0" drop
		iifname "ertap*" drop
		iifname "erbr*" drop
	}
	chain forward {
		type filter hook forward priority filter; policy accept;
		iifname "ertap*" meta nfproto ipv6 drop
		iifname "erbr*" meta nfproto ipv6 drop
		iifname "ertap0" ip saddr != 10.200.0.2 drop
		iifname "ertap0" ip daddr @blocked_v4 drop
		iifname != { "ertap*", "erbr*" } oifname { "ertap*", "erbr*" } ct state established,related accept
		oifname "ertap*" drop
		oifname "erbr*" drop
		iifname "ertap0" accept
		iifname "ertap*" drop
		iifname "erbr*" drop
	}
	chain postrouting {
		type nat hook postrouting priority srcnat; policy accept;
		ip saddr 10.200.0.2 oifname != "ertap0" masquerade
	}
}