nftable rules arch

table inet filter {
    chain input {
        type filter hook input priority filter; policy drop;
        udp sport 53 queue flags bypass to 0
        iifname "lo" accept
        ct state established,related accept
        ct state invalid drop comment "early drop of invalid connections"
        ct state { established, related } accept comment "allow tracked connections"
        iif "lo" accept comment "allow from loopback"
        meta l4proto { icmp, ipv6-icmp } accept comment "allow icmp"
        tcp dport 22 accept comment "allow sshd"
        meta pkttype host limit rate 5/second burst 5 packets counter packets 25 bytes 900 reject with icmpx admin-prohibited
        counter packets 16 bytes 1514
    }

    chain forward {
        type filter hook forward priority filter; policy accept;
    }

    chain output {
        type filter hook output priority filter; policy accept;
    }
}
table ip kvm_proton_dns {
    chain prerouting {
        type nat hook prerouting priority dstnat; policy accept;
        iifname "virbr0" udp dport 53 dnat to 10.2.0.1:53
        iifname "virbr0" tcp dport 53 dnat to 10.2.0.1:53
    }

    chain forward {
        type filter hook forward priority -100; policy accept;
        iifname "virbr0" oifname "proton0" accept
        iifname "virbr0" udp dport 53 accept
        iifname "virbr0" tcp dport 53 accept
    }
}
table inet firewalld { # progname firewalld
    flags owner,persist

    ct helper helper-tftp-udp {
        type "tftp" protocol udp
        l3proto inet
    }

    chain mangle_PREROUTING {
        type filter hook prerouting priority mangle + 10; policy accept;
        jump mangle_PREROUTING_POLICIES
    }

    chain mangle_PREROUTING_POLICIES {
        iifname "docker0" jump mangle_PRE_policy_allow-host-ipv6
        iifname "docker0" jump mangle_PRE_docker
        iifname "docker0" return
        iifname "virbr0" jump mangle_PRE_policy_allow-host-ipv6
        iifname "virbr0" jump mangle_PRE_libvirt
        iifname "virbr0" return
        iifname "br-shared" jump mangle_PRE_policy_allow-host-ipv6
        iifname "br-shared" jump mangle_PRE_nm-shared
        iifname "br-shared" return
        iifname "proton0" jump mangle_PRE_policy_allow-host-ipv6
        iifname "proton0" jump mangle_PRE_public
        iifname "proton0" return
        iifname "wlp3s0" jump mangle_PRE_policy_allow-host-ipv6
        iifname "wlp3s0" jump mangle_PRE_public
        iifname "wlp3s0" return
        jump mangle_PRE_policy_allow-host-ipv6
        jump mangle_PRE_public
        return
    }

    chain nat_PREROUTING {
        type nat hook prerouting priority dstnat + 10; policy accept;
        jump nat_PREROUTING_POLICIES
    }

    chain nat_PREROUTING_POLICIES {
        iifname "docker0" jump nat_PRE_policy_allow-host-ipv6
        iifname "docker0" jump nat_PRE_docker
        iifname "docker0" return
        iifname "virbr0" jump nat_PRE_policy_allow-host-ipv6
        iifname "virbr0" jump nat_PRE_libvirt
        iifname "virbr0" return
        iifname "br-shared" jump nat_PRE_policy_allow-host-ipv6
        iifname "br-shared" jump nat_PRE_nm-shared
        iifname "br-shared" return
        iifname "proton0" jump nat_PRE_policy_allow-host-ipv6
        iifname "proton0" jump nat_PRE_public
        iifname "proton0" return
        iifname "wlp3s0" jump nat_PRE_policy_allow-host-ipv6
        iifname "wlp3s0" jump nat_PRE_public
        iifname "wlp3s0" return
        jump nat_PRE_policy_allow-host-ipv6
        jump nat_PRE_public
        return
    }

    chain nat_POSTROUTING {
        type nat hook postrouting priority srcnat + 10; policy accept;
        jump nat_POSTROUTING_POLICIES
    }

    chain nat_POSTROUTING_POLICIES {
        iifname "docker0" oifname "docker0" jump nat_POST_policy_docker-forwarding
        iifname "docker0" oifname "docker0" jump nat_POST_docker
        iifname "docker0" oifname "docker0" return
        iifname "virbr0" oifname "docker0" jump nat_POST_policy_docker-forwarding
        iifname "virbr0" oifname "docker0" jump nat_POST_docker
        iifname "virbr0" oifname "docker0" return
        iifname "br-shared" oifname "docker0" jump nat_POST_policy_docker-forwarding
        iifname "br-shared" oifname "docker0" jump nat_POST_docker
        iifname "br-shared" oifname "docker0" return
        iifname "proton0" oifname "docker0" jump nat_POST_policy_docker-forwarding
        iifname "proton0" oifname "docker0" jump nat_POST_docker
        iifname "proton0" oifname "docker0" return
        iifname "wlp3s0" oifname "docker0" jump nat_POST_policy_docker-forwarding
        iifname "wlp3s0" oifname "docker0" jump nat_POST_docker
        iifname "wlp3s0" oifname "docker0" return
        oifname "docker0" jump nat_POST_policy_docker-forwarding
        oifname "docker0" jump nat_POST_docker
        oifname "docker0" return
        iifname "docker0" oifname "virbr0" jump nat_POST_libvirt
        iifname "docker0" oifname "virbr0" return
        iifname "virbr0" oifname "virbr0" jump nat_POST_libvirt
        iifname "virbr0" oifname "virbr0" return
        iifname "br-shared" oifname "virbr0" jump nat_POST_libvirt
        iifname "br-shared" oifname "virbr0" return
        iifname "proton0" oifname "virbr0" jump nat_POST_libvirt
        iifname "proton0" oifname "virbr0" return
        iifname "wlp3s0" oifname "virbr0" jump nat_POST_libvirt
        iifname "wlp3s0" oifname "virbr0" return
        oifname "virbr0" jump nat_POST_libvirt
        oifname "virbr0" return
        iifname "docker0" oifname "br-shared" jump nat_POST_nm-shared
        iifname "docker0" oifname "br-shared" return
        iifname "virbr0" oifname "br-shared" jump nat_POST_nm-shared
        iifname "virbr0" oifname "br-shared" return
        iifname "br-shared" oifname "br-shared" jump nat_POST_nm-shared
        iifname "br-shared" oifname "br-shared" return
        iifname "proton0" oifname "br-shared" jump nat_POST_nm-shared
        iifname "proton0" oifname "br-shared" return
        iifname "wlp3s0" oifname "br-shared" jump nat_POST_nm-shared
        iifname "wlp3s0" oifname "br-shared" return
        oifname "br-shared" jump nat_POST_nm-shared
        oifname "br-shared" return
        iifname "docker0" oifname "proton0" jump nat_POST_public
        iifname "docker0" oifname "proton0" return
        iifname "virbr0" oifname "proton0" jump nat_POST_public
        iifname "virbr0" oifname "proton0" return
        iifname "br-shared" oifname "proton0" jump nat_POST_public
        iifname "br-shared" oifname "proton0" return
        iifname "proton0" oifname "proton0" jump nat_POST_public
        iifname "proton0" oifname "proton0" return
        iifname "wlp3s0" oifname "proton0" jump nat_POST_public
        iifname "wlp3s0" oifname "proton0" return
        oifname "proton0" jump nat_POST_public
        oifname "proton0" return
        iifname "docker0" oifname "wlp3s0" jump nat_POST_public
        iifname "docker0" oifname "wlp3s0" return
        iifname "virbr0" oifname "wlp3s0" jump nat_POST_public
        iifname "virbr0" oifname "wlp3s0" return
        iifname "br-shared" oifname "wlp3s0" jump nat_POST_public
        iifname "br-shared" oifname "wlp3s0" return
        iifname "proton0" oifname "wlp3s0" jump nat_POST_public
        iifname "proton0" oifname "wlp3s0" return
        iifname "wlp3s0" oifname "wlp3s0" jump nat_POST_public
        iifname "wlp3s0" oifname "wlp3s0" return
        oifname "wlp3s0" jump nat_POST_public
        oifname "wlp3s0" return
        iifname "docker0" jump nat_POST_public
        iifname "docker0" return
        iifname "virbr0" jump nat_POST_public
        iifname "virbr0" return
        iifname "br-shared" jump nat_POST_public
        iifname "br-shared" return
        iifname "proton0" jump nat_POST_public
        iifname "proton0" return
        iifname "wlp3s0" jump nat_POST_public
        iifname "wlp3s0" return
        jump nat_POST_public
        return
    }

    chain nat_OUTPUT {
        type nat hook output priority dstnat + 10; policy accept;
        jump nat_OUTPUT_POLICIES
    }

    chain nat_OUTPUT_POLICIES {
        oifname "docker0" jump nat_OUT_docker
        oifname "docker0" return
        oifname "virbr0" jump nat_OUT_libvirt
        oifname "virbr0" return
        oifname "br-shared" jump nat_OUT_nm-shared
        oifname "br-shared" return
        oifname "proton0" jump nat_OUT_public
        oifname "proton0" return
        oifname "wlp3s0" jump nat_OUT_public
        oifname "wlp3s0" return
        jump nat_OUT_public
        return
    }

    chain filter_PREROUTING {
        type filter hook prerouting priority filter + 10; policy accept;
        icmpv6 type { nd-router-advert, nd-neighbor-solicit } accept
        meta nfproto ipv6 fib saddr . mark . iif check missing drop
    }

    chain filter_INPUT {
        type filter hook input priority filter + 10; policy accept;
        ct state { established, related } accept
        ct status dnat accept
        iifname "lo" accept
        ct state invalid drop
        jump filter_INPUT_POLICIES
        reject with icmpx admin-prohibited
    }

    chain filter_FORWARD {
        type filter hook forward priority filter + 10; policy accept;
        ct state { established, related } accept
        ct status dnat accept
        iifname "lo" accept
        ct state invalid drop
        ip6 daddr { ::/96, ::ffff:0.0.0.0/96, 2002::/24, 2002:a00::/24, 2002:7f00::/24, 2002:a9fe::/32, 2002:ac10::/28, 2002:c0a8::/32, 2002:e000::/19 } reject with icmpv6 addr-unreachable
        jump filter_FORWARD_POLICIES
        reject with icmpx admin-prohibited
    }

    chain filter_OUTPUT {
        type filter hook output priority filter + 10; policy accept;
        ct state { established, related } accept
        ct status dnat accept
        oifname "lo" accept
        ip6 daddr { ::/96, ::ffff:0.0.0.0/96, 2002::/24, 2002:a00::/24, 2002:7f00::/24, 2002:a9fe::/32, 2002:ac10::/28, 2002:c0a8::/32, 2002:e000::/19 } reject with icmpv6 addr-unreachable
        jump filter_OUTPUT_POLICIES
    }

    chain filter_INPUT_POLICIES {
        iifname "docker0" jump filter_IN_policy_allow-host-ipv6
        iifname "docker0" jump filter_IN_docker
        iifname "docker0" accept
        iifname "virbr0" jump filter_IN_policy_allow-host-ipv6
        iifname "virbr0" jump filter_IN_libvirt
        iifname "virbr0" accept
        iifname "br-shared" jump filter_IN_policy_allow-host-ipv6
        iifname "br-shared" jump filter_IN_nm-shared
        iifname "br-shared" accept
        iifname "proton0" jump filter_IN_policy_allow-host-ipv6
        iifname "proton0" jump filter_IN_public
        iifname "proton0" reject with icmpx admin-prohibited
        iifname "wlp3s0" jump filter_IN_policy_allow-host-ipv6
        iifname "wlp3s0" jump filter_IN_public
        iifname "wlp3s0" reject with icmpx admin-prohibited
        jump filter_IN_policy_allow-host-ipv6
        jump filter_IN_public
        reject with icmpx admin-prohibited
    }

    chain filter_FORWARD_POLICIES {
        iifname "docker0" oifname "docker0" jump filter_FWD_policy_docker-forwarding
        iifname "docker0" oifname "docker0" jump filter_FWD_docker
        iifname "docker0" oifname "docker0" accept
        iifname "docker0" oifname "virbr0" jump filter_FWD_docker
        iifname "docker0" oifname "virbr0" accept
        iifname "docker0" oifname "br-shared" jump filter_FWD_docker
        iifname "docker0" oifname "br-shared" accept
        iifname "docker0" oifname "proton0" jump filter_FWD_docker
        iifname "docker0" oifname "proton0" accept
        iifname "docker0" oifname "wlp3s0" jump filter_FWD_docker
        iifname "docker0" oifname "wlp3s0" accept
        iifname "docker0" jump filter_FWD_docker
        iifname "docker0" accept
        iifname "virbr0" oifname "docker0" jump filter_FWD_policy_docker-forwarding
        iifname "virbr0" oifname "docker0" jump filter_FWD_libvirt
        iifname "virbr0" oifname "docker0" accept
        iifname "virbr0" oifname "virbr0" jump filter_FWD_libvirt
        iifname "virbr0" oifname "virbr0" accept
        iifname "virbr0" oifname "br-shared" jump filter_FWD_libvirt
        iifname "virbr0" oifname "br-shared" accept
        iifname "virbr0" oifname "proton0" jump filter_FWD_libvirt
        iifname "virbr0" oifname "proton0" accept
        iifname "virbr0" oifname "wlp3s0" jump filter_FWD_libvirt
        iifname "virbr0" oifname "wlp3s0" accept
        iifname "virbr0" jump filter_FWD_libvirt
        iifname "virbr0" accept
        iifname "br-shared" oifname "docker0" jump filter_FWD_policy_docker-forwarding
        iifname "br-shared" oifname "docker0" jump filter_FWD_nm-shared
        iifname "br-shared" oifname "docker0" accept
        iifname "br-shared" oifname "virbr0" jump filter_FWD_nm-shared
        iifname "br-shared" oifname "virbr0" accept
        iifname "br-shared" oifname "br-shared" jump filter_FWD_nm-shared
        iifname "br-shared" oifname "br-shared" accept
        iifname "br-shared" oifname "proton0" jump filter_FWD_nm-shared
        iifname "br-shared" oifname "proton0" accept
        iifname "br-shared" oifname "wlp3s0" jump filter_FWD_nm-shared
        iifname "br-shared" oifname "wlp3s0" accept
        iifname "br-shared" jump filter_FWD_nm-shared
        iifname "br-shared" accept
        iifname "proton0" oifname "docker0" jump filter_FWD_policy_docker-forwarding
        iifname "proton0" oifname "docker0" jump filter_FWD_public
        iifname "proton0" oifname "docker0" reject with icmpx admin-prohibited
        iifname "proton0" oifname "virbr0" jump filter_FWD_public
        iifname "proton0" oifname "virbr0" reject with icmpx admin-prohibited
        iifname "proton0" oifname "br-shared" jump filter_FWD_public
        iifname "proton0" oifname "br-shared" reject with icmpx admin-prohibited
        iifname "proton0" oifname "proton0" jump filter_FWD_public
        iifname "proton0" oifname "proton0" reject with icmpx admin-prohibited
        iifname "proton0" oifname "wlp3s0" jump filter_FWD_public
        iifname "proton0" oifname "wlp3s0" reject with icmpx admin-prohibited
        iifname "proton0" jump filter_FWD_public
        iifname "proton0" reject with icmpx admin-prohibited
        iifname "wlp3s0" oifname "docker0" jump filter_FWD_policy_docker-forwarding
        iifname "wlp3s0" oifname "docker0" jump filter_FWD_public
        iifname "wlp3s0" oifname "docker0" reject with icmpx admin-prohibited
        iifname "wlp3s0" oifname "virbr0" jump filter_FWD_public
        iifname "wlp3s0" oifname "virbr0" reject with icmpx admin-prohibited
        iifname "wlp3s0" oifname "br-shared" jump filter_FWD_public
        iifname "wlp3s0" oifname "br-shared" reject with icmpx admin-prohibited
        iifname "wlp3s0" oifname "proton0" jump filter_FWD_public
        iifname "wlp3s0" oifname "proton0" reject with icmpx admin-prohibited
        iifname "wlp3s0" oifname "wlp3s0" jump filter_FWD_public
        iifname "wlp3s0" oifname "wlp3s0" reject with icmpx admin-prohibited
        iifname "wlp3s0" jump filter_FWD_public
        iifname "wlp3s0" reject with icmpx admin-prohibited
        oifname "docker0" jump filter_FWD_policy_docker-forwarding
        oifname "docker0" jump filter_FWD_public
        oifname "docker0" reject with icmpx admin-prohibited
        oifname "virbr0" jump filter_FWD_public
        oifname "virbr0" reject with icmpx admin-prohibited
        oifname "br-shared" jump filter_FWD_public
        oifname "br-shared" reject with icmpx admin-prohibited
        oifname "proton0" jump filter_FWD_public
        oifname "proton0" reject with icmpx admin-prohibited
        oifname "wlp3s0" jump filter_FWD_public
        oifname "wlp3s0" reject with icmpx admin-prohibited
        jump filter_FWD_public
        reject with icmpx admin-prohibited
    }

    chain filter_OUTPUT_POLICIES {
        oifname "docker0" jump filter_OUT_docker
        oifname "docker0" return
        oifname "virbr0" jump filter_OUT_libvirt
        oifname "virbr0" return
        oifname "br-shared" jump filter_OUT_nm-shared
        oifname "br-shared" return
        oifname "proton0" jump filter_OUT_public
        oifname "proton0" return
        oifname "wlp3s0" jump filter_OUT_public
        oifname "wlp3s0" return
        jump filter_OUT_public
        return
    }

    chain filter_IN_public {
        jump filter_IN_public_pre
        jump filter_IN_public_log
        jump filter_IN_public_deny
        jump filter_IN_public_allow
        jump filter_IN_public_post
        meta l4proto { icmp, ipv6-icmp } accept
    }

    chain filter_IN_public_pre {
    }

    chain filter_IN_public_log {
    }

    chain filter_IN_public_deny {
    }

    chain filter_IN_public_allow {
        tcp dport 22 accept
        ip6 daddr fe80::/64 udp dport 546 accept
        tcp dport 16509 accept
        tcp dport 16514 accept
    }

    chain filter_IN_public_post {
    }

    chain filter_OUT_public {
        jump filter_OUT_public_pre
        jump filter_OUT_public_log
        jump filter_OUT_public_deny
        jump filter_OUT_public_allow
        jump filter_OUT_public_post
    }

    chain filter_OUT_public_pre {
    }

    chain filter_OUT_public_log {
    }

    chain filter_OUT_public_deny {
    }

    chain filter_OUT_public_allow {
    }

    chain filter_OUT_public_post {
    }

    chain nat_OUT_public {
        jump nat_OUT_public_pre
        jump nat_OUT_public_log
        jump nat_OUT_public_deny
        jump nat_OUT_public_allow
        jump nat_OUT_public_post
    }

    chain nat_OUT_public_pre {
    }

    chain nat_OUT_public_log {
    }

    chain nat_OUT_public_deny {
    }

    chain nat_OUT_public_allow {
    }

    chain nat_OUT_public_post {
    }

    chain nat_POST_public {
        jump nat_POST_public_pre
        jump nat_POST_public_log
        jump nat_POST_public_deny
        jump nat_POST_public_allow
        jump nat_POST_public_post
    }

    chain nat_POST_public_pre {
    }

    chain nat_POST_public_log {
    }

    chain nat_POST_public_deny {
    }

    chain nat_POST_public_allow {
    }

    chain nat_POST_public_post {
    }

    chain filter_FWD_public {
        jump filter_FWD_public_pre
        jump filter_FWD_public_log
        jump filter_FWD_public_deny
        jump filter_FWD_public_allow
        jump filter_FWD_public_post
    }

    chain filter_FWD_public_pre {
    }

    chain filter_FWD_public_log {
    }

    chain filter_FWD_public_deny {
    }

    chain filter_FWD_public_allow {
        oifname "wlp3s0" accept
        oifname "proton0" accept
    }

    chain filter_FWD_public_post {
    }

    chain nat_PRE_public {
        jump nat_PRE_public_pre
        jump nat_PRE_public_log
        jump nat_PRE_public_deny
        jump nat_PRE_public_allow
        jump nat_PRE_public_post
    }

    chain nat_PRE_public_pre {
    }

    chain nat_PRE_public_log {
    }

    chain nat_PRE_public_deny {
    }

    chain nat_PRE_public_allow {
    }

    chain nat_PRE_public_post {
    }

    chain mangle_PRE_public {
        jump mangle_PRE_public_pre
        jump mangle_PRE_public_log
        jump mangle_PRE_public_deny
        jump mangle_PRE_public_allow
        jump mangle_PRE_public_post
    }

    chain mangle_PRE_public_pre {
    }

    chain mangle_PRE_public_log {
    }

    chain mangle_PRE_public_deny {
    }

    chain mangle_PRE_public_allow {
    }

    chain mangle_PRE_public_post {
    }

    chain filter_IN_libvirt {
        jump filter_IN_libvirt_pre
        jump filter_IN_libvirt_log
        jump filter_IN_libvirt_deny
        jump filter_IN_libvirt_allow
        jump filter_IN_libvirt_post
    }

    chain filter_IN_libvirt_pre {
    }

    chain filter_IN_libvirt_log {
    }

    chain filter_IN_libvirt_deny {
    }

    chain filter_IN_libvirt_allow {
        udp dport 67 accept
        udp dport 547 accept
        tcp dport 53 accept
        udp dport 53 accept
        tcp dport 22 accept
        udp dport 69 ct helper set "helper-tftp-udp"
        udp dport 69 accept
        meta l4proto icmp accept
        meta l4proto ipv6-icmp accept
    }

    chain filter_IN_libvirt_post {
        reject
    }

    chain filter_OUT_libvirt {
        jump filter_OUT_libvirt_pre
        jump filter_OUT_libvirt_log
        jump filter_OUT_libvirt_deny
        jump filter_OUT_libvirt_allow
        jump filter_OUT_libvirt_post
    }

    chain filter_OUT_libvirt_pre {
    }

    chain filter_OUT_libvirt_log {
    }

    chain filter_OUT_libvirt_deny {
    }

    chain filter_OUT_libvirt_allow {
    }

    chain filter_OUT_libvirt_post {
    }

    chain nat_OUT_libvirt {
        jump nat_OUT_libvirt_pre
        jump nat_OUT_libvirt_log
        jump nat_OUT_libvirt_deny
        jump nat_OUT_libvirt_allow
        jump nat_OUT_libvirt_post
    }

    chain nat_OUT_libvirt_pre {
    }

    chain nat_OUT_libvirt_log {
    }

    chain nat_OUT_libvirt_deny {
    }

    chain nat_OUT_libvirt_allow {
    }

    chain nat_OUT_libvirt_post {
    }

    chain nat_POST_libvirt {
        jump nat_POST_libvirt_pre
        jump nat_POST_libvirt_log
        jump nat_POST_libvirt_deny
        jump nat_POST_libvirt_allow
        jump nat_POST_libvirt_post
    }

    chain nat_POST_libvirt_pre {
    }

    chain nat_POST_libvirt_log {
    }

    chain nat_POST_libvirt_deny {
    }

    chain nat_POST_libvirt_allow {
    }

    chain nat_POST_libvirt_post {
    }

    chain filter_FWD_libvirt {
        jump filter_FWD_libvirt_pre
        jump filter_FWD_libvirt_log
        jump filter_FWD_libvirt_deny
        jump filter_FWD_libvirt_allow
        jump filter_FWD_libvirt_post
    }

    chain filter_FWD_libvirt_pre {
    }

    chain filter_FWD_libvirt_log {
    }

    chain filter_FWD_libvirt_deny {
    }

    chain filter_FWD_libvirt_allow {
    }

    chain filter_FWD_libvirt_post {
    }

    chain nat_PRE_libvirt {
        jump nat_PRE_libvirt_pre
        jump nat_PRE_libvirt_log
        jump nat_PRE_libvirt_deny
        jump nat_PRE_libvirt_allow
        jump nat_PRE_libvirt_post
    }

    chain nat_PRE_libvirt_pre {
    }

    chain nat_PRE_libvirt_log {
    }

    chain nat_PRE_libvirt_deny {
    }

    chain nat_PRE_libvirt_allow {
    }

    chain nat_PRE_libvirt_post {
    }

    chain mangle_PRE_libvirt {
        jump mangle_PRE_libvirt_pre
        jump mangle_PRE_libvirt_log
        jump mangle_PRE_libvirt_deny
        jump mangle_PRE_libvirt_allow
        jump mangle_PRE_libvirt_post
    }

    chain mangle_PRE_libvirt_pre {
    }

    chain mangle_PRE_libvirt_log {
    }

    chain mangle_PRE_libvirt_deny {
    }

    chain mangle_PRE_libvirt_allow {
    }

    chain mangle_PRE_libvirt_post {
    }

    chain filter_IN_policy_allow-host-ipv6 {
        jump filter_IN_policy_allow-host-ipv6_pre
        jump filter_IN_policy_allow-host-ipv6_log
        jump filter_IN_policy_allow-host-ipv6_deny
        jump filter_IN_policy_allow-host-ipv6_allow
        jump filter_IN_policy_allow-host-ipv6_post
    }

    chain filter_IN_policy_allow-host-ipv6_pre {
    }

    chain filter_IN_policy_allow-host-ipv6_log {
    }

    chain filter_IN_policy_allow-host-ipv6_deny {
    }

    chain filter_IN_policy_allow-host-ipv6_allow {
        icmpv6 type mld-listener-done accept
        icmpv6 type mld-listener-query accept
        icmpv6 type mld-listener-report accept
        icmpv6 type mld2-listener-report accept
        icmpv6 type nd-neighbor-advert icmpv6 code 0 accept
        icmpv6 type nd-neighbor-solicit icmpv6 code 0 accept
        icmpv6 type nd-redirect icmpv6 code 0 accept
        icmpv6 type nd-router-advert icmpv6 code 0 accept
    }

    chain filter_IN_policy_allow-host-ipv6_post {
    }

    chain nat_PRE_policy_allow-host-ipv6 {
        jump nat_PRE_policy_allow-host-ipv6_pre
        jump nat_PRE_policy_allow-host-ipv6_log
        jump nat_PRE_policy_allow-host-ipv6_deny
        jump nat_PRE_policy_allow-host-ipv6_allow
        jump nat_PRE_policy_allow-host-ipv6_post
    }

    chain nat_PRE_policy_allow-host-ipv6_pre {
    }

    chain nat_PRE_policy_allow-host-ipv6_log {
    }

    chain nat_PRE_policy_allow-host-ipv6_deny {
    }

    chain nat_PRE_policy_allow-host-ipv6_allow {
    }

    chain nat_PRE_policy_allow-host-ipv6_post {
    }

    chain mangle_PRE_policy_allow-host-ipv6 {
        jump mangle_PRE_policy_allow-host-ipv6_pre
        jump mangle_PRE_policy_allow-host-ipv6_log
        jump mangle_PRE_policy_allow-host-ipv6_deny
        jump mangle_PRE_policy_allow-host-ipv6_allow
        jump mangle_PRE_policy_allow-host-ipv6_post
    }

    chain mangle_PRE_policy_allow-host-ipv6_pre {
    }

    chain mangle_PRE_policy_allow-host-ipv6_log {
    }

    chain mangle_PRE_policy_allow-host-ipv6_deny {
    }

    chain mangle_PRE_policy_allow-host-ipv6_allow {
    }

    chain mangle_PRE_policy_allow-host-ipv6_post {
    }

    chain filter_IN_nm-shared {
        jump filter_IN_nm-shared_pre
        jump filter_IN_nm-shared_log
        jump filter_IN_nm-shared_deny
        jump filter_IN_nm-shared_allow
        jump filter_IN_nm-shared_post
    }

    chain filter_IN_nm-shared_pre {
    }

    chain filter_IN_nm-shared_log {
    }

    chain filter_IN_nm-shared_deny {
    }

    chain filter_IN_nm-shared_allow {
        udp dport 67 accept
        tcp dport 53 accept
        udp dport 53 accept
        tcp dport 22 accept
        meta l4proto icmp accept
        meta l4proto ipv6-icmp accept
    }

    chain filter_IN_nm-shared_post {
        reject
    }

    chain filter_OUT_nm-shared {
        jump filter_OUT_nm-shared_pre
        jump filter_OUT_nm-shared_log
        jump filter_OUT_nm-shared_deny
        jump filter_OUT_nm-shared_allow
        jump filter_OUT_nm-shared_post
    }

    chain filter_OUT_nm-shared_pre {
    }

    chain filter_OUT_nm-shared_log {
    }

    chain filter_OUT_nm-shared_deny {
    }

    chain filter_OUT_nm-shared_allow {
    }

    chain filter_OUT_nm-shared_post {
    }

    chain nat_OUT_nm-shared {
        jump nat_OUT_nm-shared_pre
        jump nat_OUT_nm-shared_log
        jump nat_OUT_nm-shared_deny
        jump nat_OUT_nm-shared_allow
        jump nat_OUT_nm-shared_post
    }

    chain nat_OUT_nm-shared_pre {
    }

    chain nat_OUT_nm-shared_log {
    }

    chain nat_OUT_nm-shared_deny {
    }

    chain nat_OUT_nm-shared_allow {
    }

    chain nat_OUT_nm-shared_post {
    }

    chain nat_POST_nm-shared {
        jump nat_POST_nm-shared_pre
        jump nat_POST_nm-shared_log
        jump nat_POST_nm-shared_deny
        jump nat_POST_nm-shared_allow
        jump nat_POST_nm-shared_post
    }

    chain nat_POST_nm-shared_pre {
    }

    chain nat_POST_nm-shared_log {
    }

    chain nat_POST_nm-shared_deny {
    }

    chain nat_POST_nm-shared_allow {
    }

    chain nat_POST_nm-shared_post {
    }

    chain filter_FWD_nm-shared {
        jump filter_FWD_nm-shared_pre
        jump filter_FWD_nm-shared_log
        jump filter_FWD_nm-shared_deny
        jump filter_FWD_nm-shared_allow
        jump filter_FWD_nm-shared_post
    }

    chain filter_FWD_nm-shared_pre {
    }

    chain filter_FWD_nm-shared_log {
    }

    chain filter_FWD_nm-shared_deny {
    }

    chain filter_FWD_nm-shared_allow {
    }

    chain filter_FWD_nm-shared_post {
    }

    chain nat_PRE_nm-shared {
        jump nat_PRE_nm-shared_pre
        jump nat_PRE_nm-shared_log
        jump nat_PRE_nm-shared_deny
        jump nat_PRE_nm-shared_allow
        jump nat_PRE_nm-shared_post
    }

    chain nat_PRE_nm-shared_pre {
    }

    chain nat_PRE_nm-shared_log {
    }

    chain nat_PRE_nm-shared_deny {
    }

    chain nat_PRE_nm-shared_allow {
    }

    chain nat_PRE_nm-shared_post {
    }

    chain mangle_PRE_nm-shared {
        jump mangle_PRE_nm-shared_pre
        jump mangle_PRE_nm-shared_log
        jump mangle_PRE_nm-shared_deny
        jump mangle_PRE_nm-shared_allow
        jump mangle_PRE_nm-shared_post
    }

    chain mangle_PRE_nm-shared_pre {
    }

    chain mangle_PRE_nm-shared_log {
    }

    chain mangle_PRE_nm-shared_deny {
    }

    chain mangle_PRE_nm-shared_allow {
    }

    chain mangle_PRE_nm-shared_post {
    }

    chain filter_IN_docker {
        jump filter_IN_docker_pre
        jump filter_IN_docker_log
        jump filter_IN_docker_deny
        jump filter_IN_docker_allow
        jump filter_IN_docker_post
    }

    chain filter_IN_docker_pre {
    }

    chain filter_IN_docker_log {
    }

    chain filter_IN_docker_deny {
    }

    chain filter_IN_docker_allow {
    }

    chain filter_IN_docker_post {
    }

    chain filter_OUT_docker {
        jump filter_OUT_docker_pre
        jump filter_OUT_docker_log
        jump filter_OUT_docker_deny
        jump filter_OUT_docker_allow
        jump filter_OUT_docker_post
    }

    chain filter_OUT_docker_pre {
    }

    chain filter_OUT_docker_log {
    }

    chain filter_OUT_docker_deny {
    }

    chain filter_OUT_docker_allow {
    }

    chain filter_OUT_docker_post {
    }

    chain nat_OUT_docker {
        jump nat_OUT_docker_pre
        jump nat_OUT_docker_log
        jump nat_OUT_docker_deny
        jump nat_OUT_docker_allow
        jump nat_OUT_docker_post
    }

    chain nat_OUT_docker_pre {
    }

    chain nat_OUT_docker_log {
    }

    chain nat_OUT_docker_deny {
    }

    chain nat_OUT_docker_allow {
    }

    chain nat_OUT_docker_post {
    }

    chain nat_POST_docker {
        jump nat_POST_docker_pre
        jump nat_POST_docker_log
        jump nat_POST_docker_deny
        jump nat_POST_docker_allow
        jump nat_POST_docker_post
    }

    chain nat_POST_docker_pre {
    }

    chain nat_POST_docker_log {
    }

    chain nat_POST_docker_deny {
    }

    chain nat_POST_docker_allow {
    }

    chain nat_POST_docker_post {
    }

    chain filter_FWD_docker {
        jump filter_FWD_docker_pre
        jump filter_FWD_docker_log
        jump filter_FWD_docker_deny
        jump filter_FWD_docker_allow
        jump filter_FWD_docker_post
    }

    chain filter_FWD_docker_pre {
    }

    chain filter_FWD_docker_log {
    }

    chain filter_FWD_docker_deny {
    }

    chain filter_FWD_docker_allow {
        oifname "docker0" accept
    }

    chain filter_FWD_docker_post {
    }

    chain nat_PRE_docker {
        jump nat_PRE_docker_pre
        jump nat_PRE_docker_log
        jump nat_PRE_docker_deny
        jump nat_PRE_docker_allow
        jump nat_PRE_docker_post
    }

    chain nat_PRE_docker_pre {
    }

    chain nat_PRE_docker_log {
    }

    chain nat_PRE_docker_deny {
    }

    chain nat_PRE_docker_allow {
    }

    chain nat_PRE_docker_post {
    }

    chain mangle_PRE_docker {
        jump mangle_PRE_docker_pre
        jump mangle_PRE_docker_log
        jump mangle_PRE_docker_deny
        jump mangle_PRE_docker_allow
        jump mangle_PRE_docker_post
    }

    chain mangle_PRE_docker_pre {
    }

    chain mangle_PRE_docker_log {
    }

    chain mangle_PRE_docker_deny {
    }

    chain mangle_PRE_docker_allow {
    }

    chain mangle_PRE_docker_post {
    }

    chain filter_FWD_policy_docker-forwarding {
        jump filter_FWD_policy_docker-forwarding_pre
        jump filter_FWD_policy_docker-forwarding_log
        jump filter_FWD_policy_docker-forwarding_deny
        jump filter_FWD_policy_docker-forwarding_allow
        jump filter_FWD_policy_docker-forwarding_post
        accept
    }

    chain filter_FWD_policy_docker-forwarding_pre {
    }

    chain filter_FWD_policy_docker-forwarding_log {
    }

    chain filter_FWD_policy_docker-forwarding_deny {
    }

    chain filter_FWD_policy_docker-forwarding_allow {
    }

    chain filter_FWD_policy_docker-forwarding_post {
    }

    chain nat_POST_policy_docker-forwarding {
        jump nat_POST_policy_docker-forwarding_pre
        jump nat_POST_policy_docker-forwarding_log
        jump nat_POST_policy_docker-forwarding_deny
        jump nat_POST_policy_docker-forwarding_allow
        jump nat_POST_policy_docker-forwarding_post
    }

    chain nat_POST_policy_docker-forwarding_pre {
    }

    chain nat_POST_policy_docker-forwarding_log {
    }

    chain nat_POST_policy_docker-forwarding_deny {
    }

    chain nat_POST_policy_docker-forwarding_allow {
    }

    chain nat_POST_policy_docker-forwarding_post {
    }
}
table inet nat {
    chain filter-prerouting {
        type filter hook prerouting priority filter; policy accept;
    }

    chain prerouting {
        type nat hook prerouting priority dstnat; policy accept;
    }

    chain postrouting {
        type nat hook postrouting priority srcnat; policy accept;
    }

    chain input {
        type nat hook input priority srcnat; policy accept;
    }

    chain output {
        type nat hook output priority 100; policy accept;
    }
}
table inet mangle {
    chain prerouting {
        type filter hook prerouting priority mangle; policy accept;
    }

    chain postrouting {
        type filter hook postrouting priority mangle; policy accept;
    }

    chain output {
        type filter hook output priority mangle; policy accept;
        ip daddr 127.0.0.0-127.255.255.255 accept
        icmp type { echo-reply, destination-unreachable, echo-request } accept
        icmpv6 type { destination-unreachable, echo-request, echo-reply } accept
        meta l4proto != tcp ct state related,new queue flags bypass to 0
        tcp flags & (fin | syn | rst | ack) == syn queue flags bypass to 0
    }

    chain forward {
        type filter hook forward priority mangle; policy accept;
    }
}
table ip nm-shared-br-shared {
    chain nat_postrouting {
        type nat hook postrouting priority srcnat; policy accept;
        ip saddr 10.42.0.0/24 ip daddr != 10.42.0.0/24 masquerade
    }

    chain filter_forward {
        type filter hook forward priority filter; policy accept;
        ip daddr 10.42.0.0/24 oifname "br-shared" ct state { established, related } accept
        ip saddr 10.42.0.0/24 iifname "br-shared" accept
        iifname "br-shared" oifname "br-shared" accept
        iifname "br-shared" reject
        oifname "br-shared" reject
    }
}
table ip libvirt_network {
    comment "Managed by libvirt for virtual networks: https://libvirt.org/firewall.html#the-virtual-network-driver"
    chain forward {
        type filter hook forward priority filter; policy accept;
        counter packets 0 bytes 0 jump guest_cross
        counter packets 0 bytes 0 jump guest_input
        counter packets 0 bytes 0 jump guest_output
    }

    chain guest_output {
        ip saddr 192.168.122.0/24 iif "virbr0" counter packets 0 bytes 0 accept
        iif "virbr0" counter packets 0 bytes 0 reject
    }

    chain guest_input {
        oif "virbr0" ip daddr 192.168.122.0/24 ct state established,related counter packets 0 bytes 0 accept
        oif "virbr0" counter packets 0 bytes 0 reject
    }

    chain guest_cross {
        iif "virbr0" oif "virbr0" counter packets 0 bytes 0 accept
    }

    chain guest_nat {
        type nat hook postrouting priority srcnat; policy accept;
        ip saddr 192.168.122.0/24 ip daddr 224.0.0.0/24 counter packets 0 bytes 0 return
        ip saddr 192.168.122.0/24 ip daddr 255.255.255.255 counter packets 0 bytes 0 return
        meta l4proto tcp ip saddr 192.168.122.0/24 ip daddr != 192.168.122.0/24 counter packets 0 bytes 0 masquerade to :1024-65535
        meta l4proto udp ip saddr 192.168.122.0/24 ip daddr != 192.168.122.0/24 counter packets 0 bytes 0 masquerade to :1024-65535
        ip saddr 192.168.122.0/24 ip daddr != 192.168.122.0/24 counter packets 0 bytes 0 masquerade
    }
}
table ip6 libvirt_network {
    comment "Managed by libvirt for virtual networks: https://libvirt.org/firewall.html#the-virtual-network-driver"
    chain forward {
        type filter hook forward priority filter; policy accept;
        counter packets 0 bytes 0 jump guest_cross
        counter packets 0 bytes 0 jump guest_input
        counter packets 0 bytes 0 jump guest_output
    }

    chain guest_output {
    }

    chain guest_input {
    }

    chain guest_cross {
    }

    chain guest_nat {
        type nat hook postrouting priority srcnat; policy accept;
    }
}
table ip nat {
    chain DOCKER {
    }

    chain PREROUTING {
        type nat hook prerouting priority dstnat; policy accept;
        xt match "addrtype" counter packets 2 bytes 2520 jump DOCKER
    }

    chain OUTPUT {
        type nat hook output priority dstnat; policy accept;
        ip daddr != 127.0.0.0/8 xt match "addrtype" counter packets 0 bytes 0 jump DOCKER
    }

    chain POSTROUTING {
        type nat hook postrouting priority srcnat; policy accept;
        ip saddr 172.17.0.0/16 oifname != "docker0" counter packets 0 bytes 0 xt target "MASQUERADE"
    }
}
table ip filter {
    chain DOCKER {
        iifname != "docker0" oifname "docker0" counter packets 0 bytes 0 drop
    }

    chain DOCKER-FORWARD {
        counter packets 0 bytes 0 jump DOCKER-CT
        counter packets 0 bytes 0 jump DOCKER-INTERNAL
        counter packets 0 bytes 0 jump DOCKER-BRIDGE
        iifname "docker0" counter packets 0 bytes 0 accept
    }

    chain DOCKER-BRIDGE {
        oifname "docker0" counter packets 0 bytes 0 jump DOCKER
    }

    chain DOCKER-CT {
        oifname "docker0" xt match "conntrack" counter packets 0 bytes 0 accept
    }

    chain DOCKER-INTERNAL {
    }

    chain FORWARD {
        type filter hook forward priority filter; policy accept;
        counter packets 0 bytes 0 jump DOCKER-USER
        counter packets 0 bytes 0 jump DOCKER-FORWARD
    }

    chain DOCKER-USER {
    }
}
table ip6 nat {
    chain DOCKER {
    }

    chain PREROUTING {
        type nat hook prerouting priority dstnat; policy accept;
        xt match "addrtype" counter packets 0 bytes 0 jump DOCKER
    }

    chain OUTPUT {
        type nat hook output priority dstnat; policy accept;
        ip6 daddr != ::1 xt match "addrtype" counter packets 0 bytes 0 jump DOCKER
    }
}
table ip6 filter {
    chain DOCKER {
    }

    chain DOCKER-FORWARD {
        counter packets 0 bytes 0 jump DOCKER-CT
        counter packets 0 bytes 0 jump DOCKER-INTERNAL
        counter packets 0 bytes 0 jump DOCKER-BRIDGE
    }

    chain DOCKER-BRIDGE {
    }

    chain DOCKER-CT {
    }

    chain DOCKER-INTERNAL {
    }

    chain FORWARD {
        type filter hook forward priority filter; policy accept;
        counter packets 0 bytes 0 jump DOCKER-USER
        counter packets 0 bytes 0 jump DOCKER-FORWARD
    }

    chain DOCKER-USER {
    }
}
table ip nm-wg-proton0 {
    chain preraw {
        iifname != "proton0" ip daddr 10.2.0.2 fib saddr type != local drop
    }

    chain premangle {
        type filter hook prerouting priority mangle; policy accept;
        meta l4proto udp meta mark set ct mark
    }

    chain postmangle {
        type filter hook postrouting priority mangle; policy accept;
        meta l4proto udp meta mark 0x8c7d4946 ct mark set meta mark
    }
}