---

table inet zapret {
        set zapret {
                type ipv4_addr
                size 522288
                flags interval
                auto-merge
        }

        set ipban {
                type ipv4_addr
                size 522288
                flags interval
                auto-merge
        }

        set nozapret {
                type ipv4_addr
                size 65536      # count 6
                flags interval
                auto-merge
                elements = { 10.0.0.0/8, 100.64.0.0/10,
                             127.0.0.0/8, 169.254.0.0/16,
                             172.16.0.0/12, 192.168.0.0/16 }
        }

        set lanif {
                type ifname
                elements = { "enp6s0" }
        }

        set wanif {
                type ifname
        }

        set wanif6 {
                type ifname
        }

        map link_local {
                type ifname : ipv6_addr
        }

        chain dnat_output {
                type nat hook output priority dstnat - 1; policy accept;
        }

        chain dnat_pre {
                type nat hook prerouting priority dstnat - 1; policy accept;
        }

        chain forward {
                type filter hook forward priority filter - 1; policy accept;
        }

        chain input {
                type filter hook input priority filter - 1; policy accept;
                iif != "lo" jump localnet_protect
        }

        chain flow_offload {
                tcp dport { 80, 443 } ct original packets 1-9 ip daddr != @nozapret return comment "direct flow offloading exemption"
                udp dport 443 ct original packets 1-9 ip daddr != @nozapret return comment "direct flow offloading exemption"
        }

        chain localnet_protect {
                ip daddr 127.0.0.127 return comment "route_localnet allow access to tpws"
                ip daddr 127.0.0.0/8 drop comment "route_localnet remote access protection"
        }

        chain postrouting {
        }

        chain postrouting_hook {
                type filter hook postrouting priority srcnat - 1; policy accept;
                meta mark & 0x40000000 == 0x00000000 jump postrouting
        }

        chain postnat {
                udp dport 443 ct original packets 1-9 ip daddr != @nozapret meta mark set meta mark | 0x20000000 ct mark set ct mark | 0x40000000 queue flags bypass to 200
                tcp dport { 80, 443 } ct original packets 1-9 ip daddr != @nozapret meta mark set meta mark | 0x20000000 ct mark set ct mark | 0x40000000 queue flags bypass to 200
        }

        chain postnat_hook {
                type filter hook postrouting priority srcnat + 1; policy accept;
                meta mark & 0x40000000 == 0x00000000 jump postnat
        }

        chain prerouting {
                type filter hook prerouting priority dstnat + 1; policy accept;
                icmp type time-exceeded ct state invalid drop
                icmp type time-exceeded ct mark & 0x40000000 != 0x00000000 drop comment "nfqws related : prevent ttl expired socket errors"
        }

        chain prenat {
                type filter hook prerouting priority dstnat - 1; policy accept;
                tcp sport { 80, 443 } ct reply packets 1-3 ip saddr != @nozapret ct mark set ct mark | 0x40000000 queue flags bypass to 200
        }

        chain predefrag {
                type filter hook output priority -401; policy accept;
                meta mark & 0x40000000 != 0x00000000 jump predefrag_nfqws comment "nfqws generated : avoid drop by INVALID conntrack state"
        }

        chain predefrag_nfqws {
                meta mark & 0x20000000 != 0x00000000 notrack comment "postnat traffic"
                ip frag-off & 0x1fff != 0x0 notrack comment "ipfrag"
                exthdr frag exists notrack comment "ipfrag"
                tcp flags ! syn,rst,ack notrack comment "datanoack"
        }
}
# Warning: table ip filter is managed by iptables-nft, do not touch!
table ip filter {
        chain INPUT {
                type filter hook input priority filter; policy accept;
                counter packets 1179 bytes 301591 jump ts-input
        }

        chain FORWARD {
                type filter hook forward priority filter; policy accept;
                counter packets 0 bytes 0 jump ts-forward
        }

        chain ts-input {
                ip saddr 100.73.35.64 iifname "lo" counter packets 0 bytes 0 accept
                iifname "tailscale0" counter packets 98 bytes 39628 accept
                udp dport 41641 counter packets 173 bytes 11838 accept
                ip saddr 100.115.92.0/23 iifname != "tailscale0" counter packets 0 bytes 0 return
                ip saddr 100.64.0.0/10 iifname != "tailscale0" counter packets 0 bytes 0 drop
        }

        chain ts-forward {
                iifname "tailscale0" counter packets 0 bytes 0 xt target "MARK"
                meta mark & 0x00ff0000 == 0x00040000 counter packets 0 bytes 0 accept
                ip saddr 100.64.0.0/10 oifname "tailscale0" counter packets 0 bytes 0 drop
                oifname "tailscale0" counter packets 0 bytes 0 accept
        }
}
# Warning: table ip nat is managed by iptables-nft, do not touch!
table ip nat {
        chain POSTROUTING {
                type nat hook postrouting priority srcnat; policy accept;
                counter packets 319 bytes 21294 jump ts-postrouting
        }

        chain ts-postrouting {
                meta mark & 0x00ff0000 == 0x00040000 counter packets 0 bytes 0 xt target "MASQUERADE"
        }
}
# Warning: table ip6 filter is managed by iptables-nft, do not touch!
table ip6 filter {
        chain INPUT {
                type filter hook input priority filter; policy accept;
                counter packets 0 bytes 0 jump ts-input
        }

        chain FORWARD {
                type filter hook forward priority filter; policy accept;
                counter packets 0 bytes 0 jump ts-forward
        }

        chain ts-input {
                ip6 saddr fd7a:115c:a1e0::7f34:2341 iifname "lo" counter packets 0 bytes 0 accept
                iifname "tailscale0" counter packets 0 bytes 0 accept
                udp dport 41641 counter packets 0 bytes 0 accept
        }

        chain ts-forward {
                iifname "tailscale0" counter packets 0 bytes 0 xt target "MARK"
                meta mark & 0x00ff0000 == 0x00040000 counter packets 0 bytes 0 accept
                oifname "tailscale0" counter packets 0 bytes 0 accept
        }
}
# Warning: table ip6 nat is managed by iptables-nft, do not touch!
table ip6 nat {
        chain POSTROUTING {
                type nat hook postrouting priority srcnat; policy accept;
                counter packets 0 bytes 0 jump ts-postrouting
        }

        chain ts-postrouting {
                meta mark & 0x00ff0000 == 0x00040000 counter packets 0 bytes 0 xt target "MASQUERADE"
        }
}
# Warning: table ip mangle is managed by iptables-nft, do not touch!
table ip mangle {
        chain PREROUTING {
                type filter hook prerouting priority mangle; policy accept;
                xt match "conntrack" xt match "connmark" counter packets 267 bytes 51669 xt target "CONNMARK"
        }

        chain OUTPUT {
                type route hook output priority mangle; policy accept;
                xt match "conntrack" meta mark & 0x00ff0000 != 0x00000000 counter packets 129 bytes 8796 xt target "CONNMARK"
        }
}
# Warning: table ip6 mangle is managed by iptables-nft, do not touch!
table ip6 mangle {
        chain PREROUTING {
                type filter hook prerouting priority mangle; policy accept;
                xt match "conntrack" xt match "connmark" counter packets 0 bytes 0 xt target "CONNMARK"
        }

        chain OUTPUT {
                type route hook output priority mangle; policy accept;
                xt match "conntrack" meta mark & 0x00ff0000 != 0x00000000 counter packets 0 bytes 0 xt target "CONNMARK"
        }
}