root@ali-lite-bj-speed ~# cat up
table inet filter {
        chain input {
                type filter hook input priority filter; policy accept;
        }

        chain forward {
                type filter hook forward priority filter; policy accept;
        }

        chain output {
                type filter hook output priority filter; policy accept;
        }
}
table ip filter {
        chain ts-input {
                ip saddr 100.122.207.24 iifname "lo" counter packets 0 bytes 0 accept
                ip saddr 100.115.92.0/23 iifname != "tailscale0" counter packets 0 bytes 0 return
                ip saddr 100.64.0.0/10 iifname != "tailscale0" counter packets 138 bytes 12784 drop
                iifname "tailscale0" counter packets 0 bytes 0 accept
                udp dport 44817 counter packets 76 bytes 4560 accept
        }

        chain ts-forward {
                iifname "tailscale0" counter packets 0 bytes 0 xt target "MARK"
                meta mark & 0x00ff0000 == 0x00040000 counter packets 0 bytes 0 accept
                ip saddr 100.64.0.0/10 oifname "tailscale0" counter packets 0 bytes 0 drop
                oifname "tailscale0" counter packets 0 bytes 0 accept
        }

        chain INPUT {
                type filter hook input priority filter; policy accept;
                counter packets 690 bytes 60057 jump ts-input
        }

        chain FORWARD {
                type filter hook forward priority filter; policy accept;
                counter packets 0 bytes 0 jump ts-forward
        }
}
table ip nat {
        chain ts-postrouting {
                meta mark & 0x00ff0000 == 0x00040000 counter packets 0 bytes 0 xt target "MASQUERADE"
        }

        chain POSTROUTING {
                type nat hook postrouting priority srcnat; policy accept;
                counter packets 207 bytes 17708 jump ts-postrouting
        }
}
table ip6 filter {
        chain ts-input {
                ip6 saddr fd7a:115c:a1e0::2601:cf18 iifname "lo" counter packets 0 bytes 0 accept
                iifname "tailscale0" counter packets 0 bytes 0 accept
                udp dport 47102 counter packets 0 bytes 0 accept
        }

        chain ts-forward {
                iifname "tailscale0" counter packets 0 bytes 0 xt target "MARK"
                meta mark & 0x00ff0000 == 0x00040000 counter packets 0 bytes 0 accept
                oifname "tailscale0" counter packets 0 bytes 0 accept
        }

        chain INPUT {
                type filter hook input priority filter; policy accept;
                counter packets 0 bytes 0 jump ts-input
        }

        chain FORWARD {
                type filter hook forward priority filter; policy accept;
                counter packets 0 bytes 0 jump ts-forward
        }
}
table ip6 nat {
        chain ts-postrouting {
                meta mark & 0x00ff0000 == 0x00040000 counter packets 0 bytes 0 xt target "MASQUERADE"
        }

        chain POSTROUTING {
                type nat hook postrouting priority srcnat; policy accept;
                counter packets 0 bytes 0 jump ts-postrouting
        }
}
root@ali-lite-bj-speed ~# cat down
table inet filter {
        chain input {
                type filter hook input priority filter; policy accept;
        }

        chain forward {
                type filter hook forward priority filter; policy accept;
        }

        chain output {
                type filter hook output priority filter; policy accept;
        }
}
table ip filter {
        chain INPUT {
                type filter hook input priority filter; policy accept;
        }

        chain FORWARD {
                type filter hook forward priority filter; policy accept;
        }
}
table ip nat {
        chain POSTROUTING {
                type nat hook postrouting priority srcnat; policy accept;
        }
}
table ip6 filter {
        chain INPUT {
                type filter hook input priority filter; policy accept;
        }

        chain FORWARD {
                type filter hook forward priority filter; policy accept;
        }
}
table ip6 nat {
        chain POSTROUTING {
                type nat hook postrouting priority srcnat; policy accept;
        }
}
root@ali-lite-bj-speed ~#