===== vm101_rt_nft =====
CMD: remote_vm101 cat /etc/iproute2/rt_tables 2>/dev/null; echo; nft list ruleset 2>/dev/null | sed -n "1,360p"

#
# reserved values
#
128	prelocal
255	local
254	main
253	default
0	unspec
#
# local
#
#1	inr.ruhep

table inet fw4 {
	chain wg_guest_snat {
		type nat hook postrouting priority srcnat - 1; policy accept;
		iifname "eth0" oifname "eth2" ip daddr 192.168.30.189 udp dport 51821 counter packets 0 bytes 0 snat ip to 192.168.30.2 comment "WG_GUEST_51821_SNAT"
	}

	chain input {
		type filter hook input priority filter; policy drop;
		iif "lo" accept comment "!fw4: Accept traffic from loopback"
		ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
		tcp flags & (fin | syn | rst | ack) == syn jump syn_flood comment "!fw4: Rate limit TCP syn packets"
		iifname "eth0" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic"
		iifname "eth2" jump input_Management comment "!fw4: Handle Management IPv4/IPv6 input traffic"
		iifname "eth3" jump input_direct_in comment "!fw4: Handle direct_in IPv4/IPv6 input traffic"
		iifname "eth1" jump input_vpn_in comment "!fw4: Handle vpn_in IPv4/IPv6 input traffic"
		iifname { "vpn1", "vpn2" } jump input_vpn_out comment "!fw4: Handle vpn_out IPv4/IPv6 input traffic"
		jump handle_reject
	}

	chain forward {
		type filter hook forward priority filter; policy drop;
		ct state vmap { established : accept, related : accept } comment "!fw4: Handle forwarded flows"
		iifname "eth0" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic"
		iifname "eth2" jump forward_Management comment "!fw4: Handle Management IPv4/IPv6 forward traffic"
		iifname "eth3" jump forward_direct_in comment "!fw4: Handle direct_in IPv4/IPv6 forward traffic"
		iifname "eth1" jump forward_vpn_in comment "!fw4: Handle vpn_in IPv4/IPv6 forward traffic"
		iifname { "vpn1", "vpn2" } jump forward_vpn_out comment "!fw4: Handle vpn_out IPv4/IPv6 forward traffic"
		jump handle_reject
	}

	chain output {
		type filter hook output priority filter; policy accept;
		oif "lo" accept comment "!fw4: Accept traffic towards loopback"
		ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
		oifname "eth0" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic"
		oifname "eth2" jump output_Management comment "!fw4: Handle Management IPv4/IPv6 output traffic"
		oifname "eth3" jump output_direct_in comment "!fw4: Handle direct_in IPv4/IPv6 output traffic"
		oifname "eth1" jump output_vpn_in comment "!fw4: Handle vpn_in IPv4/IPv6 output traffic"
		oifname { "vpn1", "vpn2" } jump output_vpn_out comment "!fw4: Handle vpn_out IPv4/IPv6 output traffic"
	}

	chain prerouting {
		type filter hook prerouting priority filter; policy accept;
		iifname "eth3" jump helper_direct_in comment "!fw4: Handle direct_in IPv4/IPv6 helper assignment"
		iifname "eth1" jump helper_vpn_in comment "!fw4: Handle vpn_in IPv4/IPv6 helper assignment"
	}

	chain handle_reject {
		meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
		reject comment "!fw4: Reject any other traffic"
	}

	chain syn_flood {
		limit rate 25/second burst 50 packets return comment "!fw4: Accept SYN packets below rate-limit"
		drop comment "!fw4: Drop excess packets"
	}

	chain input_wan {
		meta nfproto ipv4 udp dport 68 counter packets 0 bytes 0 accept comment "!fw4: Allow-DHCP-Renew"
		icmp type echo-request counter packets 25 bytes 950 accept comment "!fw4: Allow-Ping"
		meta nfproto ipv4 meta l4proto igmp counter packets 0 bytes 0 accept comment "!fw4: Allow-IGMP"
		meta nfproto ipv6 udp dport 546 counter packets 0 bytes 0 accept comment "!fw4: Allow-DHCPv6"
		ip6 saddr fe80::/10 icmpv6 type . icmpv6 code { mld-listener-query . 0, mld-listener-report . 0, mld-listener-done . 0, mld2-listener-report . 0 } counter packets 0 bytes 0 accept comment "!fw4: Allow-MLD"
		icmpv6 type { destination-unreachable, time-exceeded, echo-request, echo-reply, nd-router-solicit, nd-router-advert } limit rate 1000/second burst 5 packets counter packets 4 bytes 224 accept comment "!fw4: Allow-ICMPv6-Input"
		icmpv6 type . icmpv6 code { packet-too-big . 0, parameter-problem . 0, nd-neighbor-solicit . 0, nd-neighbor-advert . 0, parameter-problem . 1 } limit rate 1000/second burst 5 packets counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Input"
		ct status dnat accept comment "!fw4: Accept port redirections"
		jump reject_from_wan
	}

	chain output_wan {
		jump accept_to_wan
	}

	chain forward_wan {
		icmpv6 type { destination-unreachable, time-exceeded, echo-request, echo-reply } limit rate 1000/second burst 5 packets counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Forward"
		icmpv6 type . icmpv6 code { packet-too-big . 0, parameter-problem . 0, parameter-problem . 1 } limit rate 1000/second burst 5 packets counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Forward"
		ct status dnat accept comment "!fw4: Accept port forwards"
		jump reject_to_wan
	}

	chain accept_to_wan {
		meta nfproto ipv4 oifname "eth0" ct state invalid counter packets 16 bytes 640 drop comment "!fw4: Prevent NAT leakage"
		oifname "eth0" counter packets 152 bytes 37012 accept comment "!fw4: accept wan IPv4/IPv6 traffic"
	}

	chain reject_from_wan {
		iifname "eth0" counter packets 6867 bytes 339562 jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
	}

	chain reject_to_wan {
		oifname "eth0" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
	}

	chain input_Management {
		ct status dnat accept comment "!fw4: Accept port redirections"
		jump accept_from_Management
	}

	chain output_Management {
		jump accept_to_Management
	}

	chain forward_Management {
		ct status dnat accept comment "!fw4: Accept port forwards"
		jump reject_to_Management
	}

	chain accept_from_Management {
		iifname "eth2" counter packets 125 bytes 7484 accept comment "!fw4: accept Management IPv4/IPv6 traffic"
	}

	chain accept_to_Management {
		meta nfproto ipv4 oifname "eth2" ct state invalid counter packets 0 bytes 0 drop comment "!fw4: Prevent NAT leakage"
		oifname "eth2" counter packets 0 bytes 0 accept comment "!fw4: accept Management IPv4/IPv6 traffic"
	}

	chain reject_to_Management {
		oifname "eth2" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject Management IPv4/IPv6 traffic"
	}

	chain input_direct_in {
		jump accept_from_direct_in
	}

	chain output_direct_in {
		jump accept_to_direct_in
	}

	chain forward_direct_in {
		jump accept_to_wan comment "!fw4: Accept direct_in to wan forwarding"
		jump reject_to_direct_in
	}

	chain helper_direct_in {
	}

	chain accept_from_direct_in {
		iifname "eth3" counter packets 3 bytes 168 accept comment "!fw4: accept direct_in IPv4/IPv6 traffic"
	}

	chain accept_to_direct_in {
		oifname "eth3" counter packets 0 bytes 0 accept comment "!fw4: accept direct_in IPv4/IPv6 traffic"
	}

	chain reject_to_direct_in {
		oifname "eth3" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject direct_in IPv4/IPv6 traffic"
	}

	chain input_vpn_in {
		icmp type echo-request counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMP-from-vpn_in-to-router"
		jump accept_from_vpn_in
	}

	chain output_vpn_in {
		jump accept_to_vpn_in
	}

	chain forward_vpn_in {
		jump accept_to_vpn_out comment "!fw4: Accept vpn_in to vpn_out forwarding"
		jump accept_to_wan comment "!fw4: Accept vpn_in to wan forwarding"
		jump reject_to_vpn_in
	}

	chain helper_vpn_in {
	}

	chain accept_from_vpn_in {
		iifname "eth1" counter packets 4 bytes 224 accept comment "!fw4: accept vpn_in IPv4/IPv6 traffic"
	}

	chain accept_to_vpn_in {
		oifname "eth1" counter packets 0 bytes 0 accept comment "!fw4: accept vpn_in IPv4/IPv6 traffic"
	}

	chain reject_to_vpn_in {
		oifname "eth1" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject vpn_in IPv4/IPv6 traffic"
	}

	chain input_vpn_out {
		jump reject_from_vpn_out
	}

	chain output_vpn_out {
		jump accept_to_vpn_out
	}

	chain forward_vpn_out {
		jump reject_to_vpn_out
	}

	chain accept_to_vpn_out {
		meta nfproto ipv4 oifname { "vpn1", "vpn2" } ct state invalid counter packets 0 bytes 0 drop comment "!fw4: Prevent NAT leakage"
		oifname { "vpn1", "vpn2" } counter packets 274 bytes 23016 accept comment "!fw4: accept vpn_out IPv4/IPv6 traffic"
	}

	chain reject_from_vpn_out {
		iifname { "vpn1", "vpn2" } counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject vpn_out IPv4/IPv6 traffic"
	}

	chain reject_to_vpn_out {
		oifname { "vpn1", "vpn2" } counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject vpn_out IPv4/IPv6 traffic"
	}

	chain dstnat {
		type nat hook prerouting priority dstnat; policy accept;
		iifname "eth0" jump dstnat_wan comment "!fw4: Handle wan IPv4/IPv6 dstnat traffic"
		iifname "eth2" jump dstnat_Management comment "!fw4: Handle Management IPv4/IPv6 dstnat traffic"
	}

	chain srcnat {
		type nat hook postrouting priority srcnat; policy accept;
		oifname "eth0" jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic"
		oifname "eth2" jump srcnat_Management comment "!fw4: Handle Management IPv4/IPv6 srcnat traffic"
		oifname { "vpn1", "vpn2" } jump srcnat_vpn_out comment "!fw4: Handle vpn_out IPv4/IPv6 srcnat traffic"
	}

	chain dstnat_wan {
		meta nfproto ipv4 udp dport 51821 counter packets 0 bytes 0 dnat ip to 10.71.1.189:51821 comment "!fw4: WG_easy_51821_to_VM103"
		meta nfproto ipv4 udp dport 51820 counter packets 0 bytes 0 dnat ip to 10.71.100.1:51820 comment "!fw4: wg_remote_to_vm100"
		meta nfproto ipv4 udp dport 51830 counter packets 0 bytes 0 dnat ip to 10.71.100.1:51830 comment "!fw4: DNAT-WG-Paid-51830-to-VM100"
	}

	chain srcnat_wan {
		meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic"
	}

	chain dstnat_Management {
		ip saddr 10.71.100.0/24 ip daddr 95.165.105.4 udp dport 51821 dnat ip to 10.71.1.189:51821 comment "!fw4: WG_easy_51821_to_VM103 (reflection)"
		ip saddr 10.71.100.0/24 ip daddr 95.165.105.4 udp dport 51820 dnat ip to 10.71.100.1:51820 comment "!fw4: wg_remote_to_vm100 (reflection)"
		ip saddr 10.71.100.0/24 ip daddr 95.165.105.4 udp dport 51830 dnat ip to 10.71.100.1:51830 comment "!fw4: DNAT-WG-Paid-51830-to-VM100 (reflection)"
	}

	chain srcnat_Management {
		ip saddr 10.71.100.0/24 ip daddr 10.71.1.189 udp dport 51821 snat ip to 10.71.100.2 comment "!fw4: WG_easy_51821_to_VM103 (reflection)"
		ip saddr 10.71.100.0/24 ip daddr 10.71.100.1 udp dport 51820 snat ip to 10.71.100.2 comment "!fw4: wg_remote_to_vm100 (reflection)"
		ip saddr 10.71.100.0/24 ip daddr 10.71.100.1 udp dport 51830 snat ip to 10.71.100.2 comment "!fw4: DNAT-WG-Paid-51830-to-VM100 (reflection)"
		ip daddr 192.168.30.186 tcp dport 65000-65535 counter packets 0 bytes 0 masquerade comment "!fw4: OMR_SERVER_SNAT_TO_MGMT"
		ip daddr 192.168.30.186 udp dport 65000-65535 counter packets 0 bytes 0 masquerade comment "!fw4: OMR_SERVER_SNAT_TO_MGMT"
		meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 Management traffic"
	}

	chain srcnat_vpn_out {
		meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 vpn_out traffic"
	}

	chain raw_prerouting {
		type filter hook prerouting priority raw; policy accept;
	}

	chain raw_output {
		type filter hook output priority raw; policy accept;
	}

	chain mangle_prerouting {
		type filter hook prerouting priority mangle; policy accept;
	}

	chain mangle_postrouting {
		type filter hook postrouting priority mangle; policy accept;
		oifname "eth0" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 egress MTU fixing"
		oifname { "vpn1", "vpn2" } tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone vpn_out IPv4/IPv6 egress MTU fixing"
	}

	chain mangle_input {
		type filter hook input priority mangle; policy accept;
	}

	chain mangle_output {
		type route hook output priority mangle; policy accept;
	}

	chain mangle_forward {
		type filter hook forward priority mangle; policy accept;
		iifname "eth0" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 ingress MTU fixing"
		iifname { "vpn1", "vpn2" } tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone vpn_out IPv4/IPv6 ingress MTU fixing"
	}
}

rc=0
