table inet ermite_runner
delete table inet ermite_runner
table inet ermite_runner {
	set blocked_v4 {
		type ipv4_addr
		flags interval
		elements = { 0.0.0.0/8, 10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.0.0.0/24, 192.0.2.0/24, 192.168.0.0/16, 198.18.0.0/15, 198.51.100.0/24, 203.0.113.0/24, 224.0.0.0/4, 240.0.0.0/4 }
	}
	chain input {
		type filter hook input priority filter; policy accept;
		iifname "ertap*" meta nfproto ipv6 drop
		iifname "erbr*" meta nfproto ipv6 drop
		ip daddr 10.200.0.5 udp dport 53 iifname != "erbr1" drop
		ip daddr 10.200.0.5 tcp dport 53 iifname != "erbr1" drop
		ip daddr 10.200.0.1 udp dport 53 iifname != "ertap0" drop
		ip daddr 10.200.0.1 tcp dport 53 iifname != "ertap0" drop
		iifname "erbr1" ip saddr 10.200.0.6 ip daddr 10.200.0.5 udp dport 53 accept
		iifname "erbr1" ip saddr 10.200.0.6 ip daddr 10.200.0.5 tcp dport 53 accept
		iifname "erbr1" drop
		iifname "ertap0" ip saddr 10.200.0.2 ip daddr 10.200.0.1 udp dport 53 accept
		iifname "ertap0" ip saddr 10.200.0.2 ip daddr 10.200.0.1 tcp dport 53 accept
		iifname "ertap0" drop
		iifname "ertap*" drop
		iifname "erbr*" drop
	}
	chain forward {
		type filter hook forward priority filter; policy accept;
		iifname "ertap*" meta nfproto ipv6 drop
		iifname "erbr*" meta nfproto ipv6 drop
		iifname "erbr1" ip saddr != 10.200.0.6 drop
		iifname "erbr1" ip daddr @blocked_v4 drop
		iifname "ertap0" ip saddr != 10.200.0.2 drop
		iifname "ertap0" ip daddr @blocked_v4 drop
		iifname != { "ertap*", "erbr*" } oifname { "ertap*", "erbr*" } ct state established,related accept
		oifname "ertap*" drop
		oifname "erbr*" drop
		iifname "erbr1" accept
		iifname "ertap0" accept
		iifname "ertap*" drop
		iifname "erbr*" drop
	}
	chain postrouting {
		type nat hook postrouting priority srcnat; policy accept;
		ip saddr 10.200.0.6 oifname != "erbr1" masquerade
		ip saddr 10.200.0.2 oifname != "ertap0" masquerade
	}
}