table inet filter {
	chain input {
		type filter hook input priority filter; policy accept;
		ct state { established, related } accept
		ct state invalid drop
		iif "lo" accept
		ip protocol icmp icmp type echo-request limit rate 10/second accept
		ip6 nexthdr ipv6-icmp icmpv6 type { echo-request, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } limit rate 10/second accept
		ip version 4 iif "lan0" udp sport 67 accept
		ip6 daddr ff02::1:2 iif "lan0" accept
		tcp dport 22 limit rate 15/minute accept
		reject
	}

	chain output {
		type filter hook output priority filter; policy accept;
		accept
	}

	chain forward {
		type filter hook forward priority filter; policy drop;
		ct state { established, related } counter accept
		ct state invalid counter drop
		ip protocol icmp icmp type echo-request limit rate 10/second accept
		ip6 nexthdr ipv6-icmp icmpv6 type { echo-request, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } limit rate 10/second accept
		tcp dport 22 ct state new,untracked limit rate 10/minute accept
		tcp dport 22004 ct state new,untracked limit rate 10/minute accept
		iif "lan0" accept
#		ip saddr 1.1.1.1 ip daddr 192.168.0.2 tcp dport 80 iif "ppp0" oif "lan0" ct state new,untracked limit rate 10/second accept
#		ip6 saddr 2a01:0123:4567:89ab::/64 ip6 daddr 2001:1:2:3::1 tcp dport 80 oif "lan0" ct state new,untracked limit rate 10/second accept
		drop
	}
}
table ip nat {
	chain prerouting {
		type nat hook prerouting priority filter; policy accept;
		iif "ppp0" tcp dport 22 dnat to 192.168.0.2:22
		ip version 4 iif "ppp0" tcp dport 80 dnat to 192.168.0.2:80
	}

	chain postrouting {
		type nat hook postrouting priority filter; policy accept;
		iif "lan0" oif "ppp0" snat to 55.55.55.55
	}
}