nf_tables conversion

root@fpbx17:~# nft list ruleset
# Warning: table ip filter is managed by iptables-nft, do not touch!
table ip filter {
        chain INPUT {
                type filter hook input priority filter; policy accept;
                counter packets 17791654 bytes 21364577644 jump fail2ban-recidive
                meta l4proto udp udp dport 1194 counter packets 0 bytes 0 jump fail2ban-openvpn
                meta l4proto tcp tcp dport { 80, 443 } counter packets 6877 bytes 915720 jump fail2ban-api
                meta l4proto tcp tcp dport { 80, 443 } counter packets 6881 bytes 915928 jump fail2ban-BadBots
                meta l4proto tcp tcp dport 21 counter packets 0 bytes 0 jump fail2ban-FTP
                counter packets 17791672 bytes 21364578580 jump fail2ban-apache-auth
                meta l4proto tcp tcp dport 22 counter packets 24610 bytes 2794170 jump fail2ban-SSH
                counter packets 17791686 bytes 21364579308 jump fail2ban-PBX-GUI
                counter packets 17791687 bytes 21364580760 jump fail2ban-SIP
                meta l4proto tcp tcp dport 22 counter packets 24610 bytes 2794170 jump fail2ban-sshd
                counter packets 22696657 bytes 26251022199 jump fpbxfirewall
        }

        chain fpbxfirewall {
                iifname "lo" counter packets 12744788 bytes 12248346313 accept
                meta l4proto tcp ct mark != 0x20 ct state related,established counter packets 9664080 bytes 13984341908 accept
                meta l4proto icmp counter packets 105461 bytes 4789000 accept
                ip daddr 255.255.255.255 counter packets 0 bytes 0 accept
                pkttype multicast counter packets 0 bytes 0 accept
                udp sport 67-68 udp dport 67-68 counter packets 79 bytes 27176 accept
                counter packets 182249 bytes 13517802 jump fpbx-rtp
                counter packets 181404 bytes 13444967 jump fpbxblacklist
                counter packets 181404 bytes 13444967 jump fpbxsignalling
                counter packets 181404 bytes 13444967 jump fpbxsmarthosts
                counter packets 181404 bytes 13444967 jump fpbxregistrations
                counter packets 181404 bytes 13444967 jump fpbxnets
                counter packets 180607 bytes 13393907 jump fpbxhosts
                counter packets 180607 bytes 13393907 jump fpbxinterfaces
                counter packets 180607 bytes 13393907 jump fpbxreject
                meta mark & 0x00000002 == 0x00000002 counter packets 0 bytes 0 jump fpbxrfw
                meta l4proto udp ct state related,established counter packets 16222 bytes 1287842 accept
                meta l4proto tcp xt match set counter packets 0 bytes 0 jump lefilter
                counter packets 164385 bytes 12106065 jump fpbxlogdrop
        }

        chain fpbx-rtp {
                udp dport 10000-20000 counter packets 845 bytes 72835 accept
                udp dport 4000-4999 counter packets 0 bytes 0 accept
        }

        chain fpbxblacklist {
        }

        chain fpbxsignalling {
                udp dport 5060 counter packets 0 bytes 0 meta mark set 0x3
        }

        chain fpbxsmarthosts {
        }

        chain fpbxregistrations {
        }

        chain fpbxnets {
                ip saddr 72.x.x.x counter packets 797 bytes 51060 jump zone-trusted
        }

        chain fpbxhosts {
                ip saddr 127.0.1.1 counter packets 0 bytes 0 jump zone-trusted
                ip saddr 127.0.0.1 counter packets 0 bytes 0 jump zone-trusted
        }

        chain fpbxinterfaces {
                iifname "enp1s0" counter packets 180588 bytes 13391444 jump zone-external
        }

        chain fpbxreject {
                counter packets 180588 bytes 13391444 jump rejsvc-nfs
                counter packets 180588 bytes 13391444 jump rejsvc-smb
        }

        chain fpbxrfw {
                xt match recent counter packets 0 bytes 0
                xt match recent counter packets 0 bytes 0 accept
                xt match recent counter packets 0 bytes 0 accept
                xt match recent counter packets 0 bytes 0 jump fpbxchecktempwhitelist
                xt match recent counter packets 0 bytes 0
                xt match recent counter packets 0 bytes 0
                xt match recent counter packets 0 bytes 0 jump fpbxattacker
                xt match recent counter packets 0 bytes 0 jump fpbxattacker
                xt match recent counter packets 0 bytes 0 jump fpbxshortblock
                xt match recent counter packets 0 bytes 0
                xt match recent counter packets 0 bytes 0 jump fpbxattacker
                counter packets 0 bytes 0 accept
        }

        chain lefilter {
                ct state new counter packets 0 bytes 0 ct mark set 0x20
                ct state new counter packets 0 bytes 0 accept
                xt match string counter packets 0 bytes 0 accept
                xt match string counter packets 0 bytes 0 accept
                counter packets 0 bytes 0 return
        }

        chain fpbxlogdrop {
                counter packets 164380 bytes 12105151 drop
        }

        chain zone-trusted {
                counter packets 797 bytes 51060 accept
        }

        chain zone-internal {
                counter packets 0 bytes 0 meta mark set mark or 0x4
                counter packets 0 bytes 0 jump fpbxsvc-ssh
                counter packets 0 bytes 0 jump fpbxsvc-http
                counter packets 0 bytes 0 jump fpbxsvc-https
                counter packets 0 bytes 0 jump fpbxsvc-ucp
                counter packets 0 bytes 0 jump fpbxsvc-ucp_ssl
                counter packets 0 bytes 0 jump fpbxsvc-pjsip
                counter packets 0 bytes 0 jump fpbxsvc-chansip
                counter packets 0 bytes 0 jump fpbxsvc-iax
                counter packets 0 bytes 0 jump fpbxsvc-webrtc
                counter packets 0 bytes 0 jump fpbxsvc-api
                counter packets 0 bytes 0 jump fpbxsvc-api_ssl
                counter packets 0 bytes 0 jump fpbxsvc-ntp
                counter packets 0 bytes 0 jump fpbxsvc-sng_phone_svc
                counter packets 0 bytes 0 jump fpbxsvc-provis
                counter packets 0 bytes 0 jump fpbxsvc-provis_ssl
                counter packets 0 bytes 0 jump fpbxsvc-vpn
                counter packets 0 bytes 0 jump fpbxsvc-restapps
                counter packets 0 bytes 0 jump fpbxsvc-restapps_ssl
                counter packets 0 bytes 0 jump fpbxsvc-xmpp
                counter packets 0 bytes 0 jump fpbxsvc-ftp
                counter packets 0 bytes 0 jump fpbxsvc-tftp
        }

        chain zone-other {
                counter packets 0 bytes 0 meta mark set mark or 0x8
                counter packets 0 bytes 0 jump fpbxsvc-ucp
                counter packets 0 bytes 0 jump fpbxsvc-ucp_ssl
                counter packets 0 bytes 0 jump fpbxsvc-provis
                counter packets 0 bytes 0 jump fpbxsvc-provis_ssl
                counter packets 0 bytes 0 jump fpbxsvc-vpn
                counter packets 0 bytes 0 jump fpbxsvc-sng_phone_svc
        }

        chain zone-external {
                counter packets 180588 bytes 13391444 meta mark set mark or 0x10
                counter packets 180588 bytes 13391444 jump fpbxsvc-vpn
                counter packets 125320 bytes 9269676 jump fpbxsvc-sng_phone_svc
        }

        chain fpbxchecktempwhitelist {
                xt match recent counter packets 0 bytes 0 jump fpbxtempwhitelist
        }

        chain fpbxattacker {
                xt match recent counter packets 0 bytes 0
                counter packets 0 bytes 0 drop
        }

        chain fpbxshortblock {
                xt match recent counter packets 0 bytes 0
                counter packets 0 bytes 0 reject
        }

        chain fpbxratelimit {
                meta mark & 0x00000004 == 0x00000004 counter packets 0 bytes 0 accept
                xt match recent counter packets 0 bytes 0 accept
                ct state new xt match recent counter packets 0 bytes 0
                ct state new xt match recent counter packets 0 bytes 0
                counter packets 0 bytes 0 log
                xt match recent counter packets 0 bytes 0 jump fpbxattacker
                xt match recent counter packets 0 bytes 0 jump fpbxattacker
                xt match recent counter packets 0 bytes 0 jump fpbxattacker
                xt match recent counter packets 0 bytes 0 jump fpbxshortblock
                counter packets 0 bytes 0 accept
        }

        chain fpbxknownreg {
                xt match recent counter packets 0 bytes 0
                xt match recent counter packets 0 bytes 0
                xt match recent counter packets 0 bytes 0
                xt match recent counter packets 0 bytes 0
                counter packets 0 bytes 0 meta mark set mark or 0x4
                meta mark & 0x00000001 == 0x00000001 counter packets 0 bytes 0 accept
                counter packets 0 bytes 0 jump fpbxsvc-ucp
                counter packets 0 bytes 0 jump fpbxsvc-restapps
                counter packets 0 bytes 0 jump fpbxsvc-restapps_ssl
                counter packets 0 bytes 0 jump fpbxsvc-provis
                counter packets 0 bytes 0 jump fpbxsvc-provis_ssl
                counter packets 0 bytes 0 jump fpbxsvc-api
                counter packets 0 bytes 0 jump fpbxsvc-api_ssl
        }

        chain fpbxsvc-ucp {
                tcp dport 81 counter packets 0 bytes 0 accept
                tcp dport 8001 counter packets 0 bytes 0 accept
        }

        chain fpbxsvc-restapps {
                tcp dport 82 counter packets 0 bytes 0 accept
        }

        chain fpbxsvc-restapps_ssl {
        }

        chain fpbxsvc-provis {
                tcp dport 84 counter packets 0 bytes 0 jump fpbxratelimit
        }

        chain fpbxsvc-provis_ssl {
        }

        chain fpbxsvc-api {
                tcp dport 83 counter packets 0 bytes 0 accept
        }

        chain fpbxsvc-api_ssl {
                tcp dport 2443 counter packets 0 bytes 0 accept
        }

        chain fpbxtempwhitelist {
                xt match recent counter packets 0 bytes 0 accept
        }

        chain fpbxsvc-ssh {
                tcp dport 22 counter packets 0 bytes 0 accept
        }

        chain fpbxsvc-http {
                tcp dport 80 counter packets 0 bytes 0 accept
        }

        chain fpbxsvc-https {
                tcp dport 443 counter packets 0 bytes 0 accept
        }

        chain fpbxsvc-ucp_ssl {
        }

        chain fpbxsvc-pjsip {
                udp dport 5060 counter packets 0 bytes 0 accept
        }

        chain fpbxsvc-chansip {
        }

        chain fpbxsvc-iax {
                udp dport 4569 counter packets 0 bytes 0 accept
        }

        chain fpbxsvc-webrtc {
                tcp dport 8088 counter packets 0 bytes 0 accept
                tcp dport 8089 counter packets 0 bytes 0 accept
        }

        chain fpbxsvc-letsencrypt {
        }

        chain fpbxsvc-ntp {
                udp dport 123 counter packets 0 bytes 0 accept
        }

        chain fpbxsvc-sng_phone_svc {
        }

        chain fpbxsvc-vpn {
                udp dport 1194 counter packets 0 bytes 0 accept
        }

        chain fpbxsvc-xmpp {
                tcp dport 5222 counter packets 0 bytes 0 accept
        }

        chain fpbxsvc-ftp {
                tcp dport 21 counter packets 0 bytes 0 accept
        }

        chain fpbxsvc-tftp {
                udp dport 69 counter packets 0 bytes 0 accept
        }

        chain fpbxsvc-nfs {
        }

        chain rejsvc-nfs {
        }

        chain fpbxsvc-smb {
        }

        chain rejsvc-smb {
        }

        chain fail2ban-sshd {
                counter packets 24610 bytes 2794170 return
        }

        chain fail2ban-SIP {
                counter packets 17791687 bytes 21364580760 return
        }

        chain fail2ban-PBX-GUI {
                counter packets 17791686 bytes 21364579308 return
        }

        chain fail2ban-SSH {
                counter packets 24610 bytes 2794170 return
        }

        chain fail2ban-apache-auth {
                counter packets 17791672 bytes 21364578580 return
        }

        chain fail2ban-FTP {
                counter packets 0 bytes 0 return
        }

        chain fail2ban-BadBots {
                counter packets 6881 bytes 915928 return
        }

        chain fail2ban-api {
                counter packets 6877 bytes 915720 return
        }

        chain fail2ban-openvpn {
                counter packets 0 bytes 0 return
        }

        chain fail2ban-recidive {
                counter packets 17791654 bytes 21364577644 return
        }
}
# Warning: table ip6 filter is managed by iptables-nft, do not touch!
table ip6 filter {
        chain fpbxfirewall {
                iifname "lo" counter packets 0 bytes 0 accept
                meta l4proto tcp ct mark != 0x20 ct state related,established counter packets 0 bytes 0 accept
                meta l4proto ipv6-icmp counter packets 0 bytes 0 accept
                pkttype multicast counter packets 0 bytes 0 accept
                udp sport 67-68 udp dport 67-68 counter packets 0 bytes 0 accept
                ip6 saddr fe80::/64 udp sport 546-547 udp dport 546-547 counter packets 0 bytes 0 accept
                counter packets 0 bytes 0 jump fpbx-rtp
                counter packets 0 bytes 0 jump fpbxblacklist
                counter packets 0 bytes 0 jump fpbxsignalling
                counter packets 0 bytes 0 jump fpbxsmarthosts
                counter packets 0 bytes 0 jump fpbxregistrations
                counter packets 0 bytes 0 jump fpbxnets
                counter packets 0 bytes 0 jump fpbxhosts
                counter packets 0 bytes 0 jump fpbxinterfaces
                counter packets 0 bytes 0 jump fpbxreject
                meta mark & 0x00000002 == 0x00000002 counter packets 0 bytes 0 jump fpbxrfw
                meta l4proto udp ct state related,established counter packets 0 bytes 0 accept
                meta l4proto tcp xt match set counter packets 0 bytes 0 jump lefilter
                counter packets 0 bytes 0 jump fpbxlogdrop
        }

        chain INPUT {
                type filter hook input priority filter; policy accept;
                counter packets 0 bytes 0 jump fail2ban-PBX-GUI
                counter packets 0 bytes 0 jump fpbxfirewall
        }

        chain fail2ban-PBX-GUI {
        }

        chain fpbx-rtp {
                udp dport 10000-20000 counter packets 0 bytes 0 accept
                udp dport 4000-4999 counter packets 0 bytes 0 accept
        }

        chain fpbxblacklist {
        }

        chain fpbxsignalling {
                udp dport 5060 counter packets 0 bytes 0 meta mark set 0x3
        }

        chain fpbxsmarthosts {
        }

        chain fpbxregistrations {
        }

        chain fpbxnets {
        }

        chain fpbxhosts {
                ip6 saddr ::1 counter packets 0 bytes 0 jump zone-trusted
                ip6 saddr ff02::1 counter packets 0 bytes 0 jump zone-trusted
                ip6 saddr ff02::2 counter packets 0 bytes 0 jump zone-trusted
        }

        chain fpbxinterfaces {
                iifname "enp1s0" counter packets 0 bytes 0 jump zone-external
        }

        chain fpbxreject {
                counter packets 0 bytes 0 jump rejsvc-nfs
                counter packets 0 bytes 0 jump rejsvc-smb
        }

        chain fpbxrfw {
                xt match recent counter packets 0 bytes 0
                xt match recent counter packets 0 bytes 0 accept
                xt match recent counter packets 0 bytes 0 accept
                xt match recent counter packets 0 bytes 0 jump fpbxchecktempwhitelist
                xt match recent counter packets 0 bytes 0
                xt match recent counter packets 0 bytes 0
                xt match recent counter packets 0 bytes 0 jump fpbxattacker
                xt match recent counter packets 0 bytes 0 jump fpbxattacker
                xt match recent counter packets 0 bytes 0 jump fpbxshortblock
                xt match recent counter packets 0 bytes 0
                xt match recent counter packets 0 bytes 0 jump fpbxattacker
                counter packets 0 bytes 0 accept
        }

        chain lefilter {
                ct state new counter packets 0 bytes 0 ct mark set 0x20
                ct state new counter packets 0 bytes 0 accept
                xt match string counter packets 0 bytes 0 accept
                xt match string counter packets 0 bytes 0 accept
                counter packets 0 bytes 0 return
        }

        chain fpbxlogdrop {
                counter packets 0 bytes 0 drop
        }

        chain zone-trusted {
                counter packets 0 bytes 0 accept
        }

        chain zone-internal {
                counter packets 0 bytes 0 meta mark set mark or 0x4
                counter packets 0 bytes 0 jump fpbxsvc-ssh
                counter packets 0 bytes 0 jump fpbxsvc-http
                counter packets 0 bytes 0 jump fpbxsvc-https
                counter packets 0 bytes 0 jump fpbxsvc-ucp
                counter packets 0 bytes 0 jump fpbxsvc-ucp_ssl
                counter packets 0 bytes 0 jump fpbxsvc-pjsip
                counter packets 0 bytes 0 jump fpbxsvc-chansip
                counter packets 0 bytes 0 jump fpbxsvc-iax
                counter packets 0 bytes 0 jump fpbxsvc-webrtc
                counter packets 0 bytes 0 jump fpbxsvc-api
                counter packets 0 bytes 0 jump fpbxsvc-api_ssl
                counter packets 0 bytes 0 jump fpbxsvc-ntp
                counter packets 0 bytes 0 jump fpbxsvc-sng_phone_svc
                counter packets 0 bytes 0 jump fpbxsvc-provis
                counter packets 0 bytes 0 jump fpbxsvc-provis_ssl
                counter packets 0 bytes 0 jump fpbxsvc-vpn
                counter packets 0 bytes 0 jump fpbxsvc-restapps
                counter packets 0 bytes 0 jump fpbxsvc-restapps_ssl
                counter packets 0 bytes 0 jump fpbxsvc-xmpp
                counter packets 0 bytes 0 jump fpbxsvc-ftp
                counter packets 0 bytes 0 jump fpbxsvc-tftp
        }

        chain zone-other {
                counter packets 0 bytes 0 meta mark set mark or 0x8
                counter packets 0 bytes 0 jump fpbxsvc-ucp
                counter packets 0 bytes 0 jump fpbxsvc-ucp_ssl
                counter packets 0 bytes 0 jump fpbxsvc-provis
                counter packets 0 bytes 0 jump fpbxsvc-provis_ssl
                counter packets 0 bytes 0 jump fpbxsvc-vpn
                counter packets 0 bytes 0 jump fpbxsvc-sng_phone_svc
        }

        chain zone-external {
                counter packets 0 bytes 0 meta mark set mark or 0x10
                counter packets 0 bytes 0 jump fpbxsvc-vpn
                counter packets 0 bytes 0 jump fpbxsvc-sng_phone_svc
        }

        chain fpbxchecktempwhitelist {
                xt match recent counter packets 0 bytes 0 jump fpbxtempwhitelist
        }

        chain fpbxattacker {
                xt match recent counter packets 0 bytes 0
                counter packets 0 bytes 0 drop
        }

        chain fpbxshortblock {
                xt match recent counter packets 0 bytes 0
                counter packets 0 bytes 0 reject
        }

        chain fpbxratelimit {
                meta mark & 0x00000004 == 0x00000004 counter packets 0 bytes 0 accept
                xt match recent counter packets 0 bytes 0 accept
                ct state new xt match recent counter packets 0 bytes 0
                ct state new xt match recent counter packets 0 bytes 0
                counter packets 0 bytes 0 log
                xt match recent counter packets 0 bytes 0 jump fpbxattacker
                xt match recent counter packets 0 bytes 0 jump fpbxattacker
                xt match recent counter packets 0 bytes 0 jump fpbxattacker
                xt match recent counter packets 0 bytes 0 jump fpbxshortblock
                counter packets 0 bytes 0 accept
        }

        chain fpbxknownreg {
                xt match recent counter packets 0 bytes 0
                xt match recent counter packets 0 bytes 0
                xt match recent counter packets 0 bytes 0
                xt match recent counter packets 0 bytes 0
                counter packets 0 bytes 0 meta mark set mark or 0x4
                meta mark & 0x00000001 == 0x00000001 counter packets 0 bytes 0 accept
                counter packets 0 bytes 0 jump fpbxsvc-ucp
                counter packets 0 bytes 0 jump fpbxsvc-restapps
                counter packets 0 bytes 0 jump fpbxsvc-restapps_ssl
                counter packets 0 bytes 0 jump fpbxsvc-provis
                counter packets 0 bytes 0 jump fpbxsvc-provis_ssl
                counter packets 0 bytes 0 jump fpbxsvc-api
                counter packets 0 bytes 0 jump fpbxsvc-api_ssl
        }

        chain fpbxsvc-ucp {
                tcp dport 81 counter packets 0 bytes 0 accept
                tcp dport 8001 counter packets 0 bytes 0 accept
        }

        chain fpbxsvc-restapps {
                tcp dport 82 counter packets 0 bytes 0 accept
        }

        chain fpbxsvc-restapps_ssl {
        }

        chain fpbxsvc-provis {
                tcp dport 84 counter packets 0 bytes 0 jump fpbxratelimit
        }

        chain fpbxsvc-provis_ssl {
        }

        chain fpbxsvc-api {
                tcp dport 83 counter packets 0 bytes 0 accept
        }

        chain fpbxsvc-api_ssl {
                tcp dport 2443 counter packets 0 bytes 0 accept
        }

        chain fpbxtempwhitelist {
                xt match recent counter packets 0 bytes 0 accept
        }

        chain fpbxsvc-ssh {
                tcp dport 22 counter packets 0 bytes 0 accept
        }

        chain fpbxsvc-http {
                tcp dport 80 counter packets 0 bytes 0 accept
        }

        chain fpbxsvc-https {
                tcp dport 443 counter packets 0 bytes 0 accept
        }

        chain fpbxsvc-ucp_ssl {
        }

        chain fpbxsvc-pjsip {
                udp dport 5060 counter packets 0 bytes 0 accept
        }

        chain fpbxsvc-chansip {
        }

        chain fpbxsvc-iax {
                udp dport 4569 counter packets 0 bytes 0 accept
        }

        chain fpbxsvc-webrtc {
                tcp dport 8088 counter packets 0 bytes 0 accept
                tcp dport 8089 counter packets 0 bytes 0 accept
        }

        chain fpbxsvc-letsencrypt {
        }

        chain fpbxsvc-ntp {
                udp dport 123 counter packets 0 bytes 0 accept
        }

        chain fpbxsvc-sng_phone_svc {
        }

        chain fpbxsvc-vpn {
                udp dport 1194 counter packets 0 bytes 0 accept
        }

        chain fpbxsvc-xmpp {
                tcp dport 5222 counter packets 0 bytes 0 accept
        }

        chain fpbxsvc-ftp {
                tcp dport 21 counter packets 0 bytes 0 accept
        }

        chain fpbxsvc-tftp {
                udp dport 69 counter packets 0 bytes 0 accept
        }

        chain fpbxsvc-nfs {
        }

        chain rejsvc-nfs {
        }

        chain fpbxsvc-smb {
        }

        chain rejsvc-smb {
        }
}
# Warning: table ip nat is managed by iptables-nft, do not touch!
table ip nat {
        chain masq-input {
                counter packets 393856 bytes 23757316 meta mark set 0x1
        }

        chain masq-output {
                oifname "enp1s0" counter packets 16615 bytes 1263590 meta mark set mark or 0x2
        }

        chain POSTROUTING {
                type nat hook postrouting priority srcnat; policy accept;
                counter packets 393856 bytes 23757316 jump masq-input
                counter packets 393856 bytes 23757316 jump masq-output
                meta mark & 0x00000003 == 0x00000003 counter packets 16615 bytes 1263590 masquerade
        }
}