nft list ruleset
	table ip filter {
		chain LIBVIRT_INP {
			iifname "virbr0" meta l4proto udp udp dport 53 counter packets 0 bytes 0 accept
			iifname "virbr0" meta l4proto tcp tcp dport 53 counter packets 0 bytes 0 accept
			iifname "virbr0" meta l4proto udp udp dport 67 counter packets 0 bytes 0 accept
			iifname "virbr0" meta l4proto tcp tcp dport 67 counter packets 0 bytes 0 accept
		}

		chain INPUT {
			type filter hook input priority filter; policy accept;
			counter packets 72137 bytes 64299978 jump LIBVIRT_INP
		}

		chain LIBVIRT_OUT {
			oifname "virbr0" meta l4proto udp udp dport 53 counter packets 0 bytes 0 accept
			oifname "virbr0" meta l4proto tcp tcp dport 53 counter packets 0 bytes 0 accept
			oifname "virbr0" meta l4proto udp udp dport 68 counter packets 0 bytes 0 accept
			oifname "virbr0" meta l4proto tcp tcp dport 68 counter packets 0 bytes 0 accept
		}

		chain OUTPUT {
			type filter hook output priority filter; policy accept;
			counter packets 45384 bytes 6668210 jump LIBVIRT_OUT
		}

		chain LIBVIRT_FWO {
			iifname "virbr0" ip saddr 192.168.100.0/24 counter packets 0 bytes 0 accept
			iifname "virbr0" counter packets 0 bytes 0 reject
		}

		chain FORWARD {
			type filter hook forward priority filter; policy accept;
			counter packets 5 bytes 1172 jump LIBVIRT_FWX
			counter packets 5 bytes 1172 jump LIBVIRT_FWI
			counter packets 5 bytes 1172 jump LIBVIRT_FWO
			iifname "pan1" counter packets 0 bytes 0 accept
			oifname "pan1" counter packets 0 bytes 0 accept
			iifname "pan1" counter packets 0 bytes 0 accept
		}

		chain LIBVIRT_FWI {
			oifname "virbr0" ip daddr 192.168.100.0/24 ct state related,established counter packets 0 bytes 0 accept
			oifname "virbr0" counter packets 0 bytes 0 reject
		}

		chain LIBVIRT_FWX {
			iifname "virbr0" oifname "virbr0" counter packets 0 bytes 0 accept
		}
	}
	table ip nat {
		chain LIBVIRT_PRT {
			ip saddr 192.168.100.0/24 ip daddr 224.0.0.0/24 counter packets 60 bytes 9518 return
			ip saddr 192.168.100.0/24 ip daddr 255.255.255.255 counter packets 0 bytes 0 return
			meta l4proto tcp ip saddr 192.168.100.0/24 ip daddr != 192.168.100.0/24 counter packets 948 bytes 60775 masquerade to :1024-65535
			meta l4proto udp ip saddr 192.168.100.0/24 ip daddr != 192.168.100.0/24 counter packets 277 bytes 43460 masquerade to :1024-65535
			ip saddr 192.168.100.0/24 ip daddr != 192.168.100.0/24 counter packets 0 bytes 0 masquerade
		}

		chain POSTROUTING {
			type nat hook postrouting priority srcnat; policy accept;
			counter packets 3803 bytes 399899 jump LIBVIRT_PRT
			ip saddr 10.100.187.0/24 counter packets 25 bytes 4125 masquerade
		}
	}
	table ip mangle {
		chain LIBVIRT_PRT {
			oifname "virbr0" meta l4proto udp udp dport 68 counter packets 0 bytes 0 # CHECKSUM fill
		}

		chain POSTROUTING {
			type filter hook postrouting priority mangle; policy accept;
			counter packets 46486 bytes 6841404 jump LIBVIRT_PRT
		}
	}
	table ip6 filter {
		chain LIBVIRT_INP {
		}

		chain INPUT {
			type filter hook input priority filter; policy accept;
			counter packets 4088 bytes 3398182 jump LIBVIRT_INP
		}

		chain LIBVIRT_OUT {
		}

		chain OUTPUT {
			type filter hook output priority filter; policy accept;
			counter packets 3865 bytes 493397 jump LIBVIRT_OUT
		}

		chain LIBVIRT_FWO {
		}

		chain FORWARD {
			type filter hook forward priority filter; policy accept;
			counter packets 0 bytes 0 jump LIBVIRT_FWX
			counter packets 0 bytes 0 jump LIBVIRT_FWI
			counter packets 0 bytes 0 jump LIBVIRT_FWO
		}

		chain LIBVIRT_FWI {
		}

		chain LIBVIRT_FWX {
		}
	}
	table ip6 nat {
		chain LIBVIRT_PRT {
		}

		chain POSTROUTING {
			type nat hook postrouting priority srcnat; policy accept;
			counter packets 0 bytes 0 jump LIBVIRT_PRT
		}
	}
	table ip6 mangle {
		chain LIBVIRT_PRT {
		}

		chain POSTROUTING {
			type filter hook postrouting priority mangle; policy accept;
			counter packets 4132 bytes 537333 jump LIBVIRT_PRT
		}
	}