sudo nft --stateless list ruleset > a 2>&1
# Warning: table ip filter is managed by iptables-nft, do not touch!
table ip filter {
	chain INPUT {
		type filter hook input priority filter; policy drop;
		ct state invalid counter drop
		ct state invalid counter drop
		tcp flags fin,syn,rst,ack / fin,syn,rst,psh,ack,urg counter drop
		tcp flags fin,syn / fin,syn counter drop
		tcp flags syn,rst / syn,rst counter drop
		ip frag-off & 8191 != 0 counter drop
		tcp flags fin,syn,rst,psh,ack,urg / fin,syn,rst,psh,ack,urg counter drop
		tcp flags ! fin,syn,rst,psh,ack,urg counter drop
		iifname "vif*" tcp dport 8082 counter accept
		iifname "lo" counter accept
		ct state established counter accept
		meta l4proto icmp xt match icmp ct state related counter accept
		meta l4proto icmp counter drop
		iifname "vif*" udp dport 5300 counter accept
		iifname "vif*" tcp dport 9040 counter accept
		iifname "vif*" tcp dport 9051 counter accept
		iifname "vif*" tcp dport 9050 counter accept
		iifname "vif*" tcp dport 9100 counter accept
		iifname "vif*" tcp dport 9101 counter accept
		iifname "vif*" tcp dport 9102 counter accept
		iifname "vif*" tcp dport 9103 counter accept
		iifname "vif*" tcp dport 9104 counter accept
		iifname "vif*" tcp dport 9105 counter accept
		iifname "vif*" tcp dport 9106 counter accept
		iifname "vif*" tcp dport 9107 counter accept
		iifname "vif*" tcp dport 9108 counter accept
		iifname "vif*" tcp dport 9109 counter accept
		iifname "vif*" tcp dport 9110 counter accept
		iifname "vif*" tcp dport 9111 counter accept
		iifname "vif*" tcp dport 9114 counter accept
		iifname "vif*" tcp dport 9115 counter accept
		iifname "vif*" tcp dport 9117 counter accept
		iifname "vif*" tcp dport 9118 counter accept
		iifname "vif*" tcp dport 9122 counter accept
		iifname "vif*" tcp dport 9123 counter accept
		iifname "vif*" tcp dport 9124 counter accept
		iifname "vif*" tcp dport 9125 counter accept
		iifname "vif*" tcp dport 9150 counter accept
		iifname "vif*" meta l4proto tcp tcp dport 9152-9189 counter accept
		counter drop
	}

	chain FORWARD {
		type filter hook forward priority filter; policy drop;
		counter reject with icmp type admin-prohibited
	}

	chain OUTPUT {
		type filter hook output priority filter; policy drop;
		oifname "vif*" tcp sport 8082 counter accept
		meta l4proto udp ip daddr 127.0.0.1 skuid 997 ct state new udp dport 5400 counter accept
		meta l4proto tcp ip daddr 127.0.0.1 skuid 997 ct state new tcp dport 9041 counter accept
		ct state invalid counter reject with icmp type admin-prohibited
		ct state invalid counter reject with icmp type admin-prohibited
		tcp flags fin,syn,rst,ack / fin,syn,rst,psh,ack,urg counter reject with icmp type admin-prohibited
		tcp flags fin,syn / fin,syn counter reject with icmp type admin-prohibited
		tcp flags syn,rst / syn,rst counter reject with icmp type admin-prohibited
		ip frag-off & 8191 != 0 counter reject with icmp type admin-prohibited
		tcp flags fin,syn,rst,psh,ack,urg / fin,syn,rst,psh,ack,urg counter reject with icmp type admin-prohibited
		tcp flags ! fin,syn,rst,psh,ack,urg counter reject with icmp type admin-prohibited
		ct state established counter accept
		oifname "lo" counter accept
		skuid 104 counter accept
		skuid 102 counter accept
		skuid 100 counter accept
		counter reject with icmp type admin-prohibited
	}
}
# Warning: table ip nat is managed by iptables-nft, do not touch!
table ip nat {
	chain PR-QBS-SERVICES {
		iifname "vif*" ip daddr 10.137.255.254 tcp dport 8082 counter redirect
	}

	chain PREROUTING {
		type nat hook prerouting priority dstnat; policy accept;
		counter jump PR-QBS-SERVICES
		iifname "vif*" ip daddr 10.137.0.0/16 tcp dport 9051 counter redirect to :9051
		iifname "vif*" ip daddr 10.138.0.0/16 tcp dport 9051 counter redirect to :9051
		iifname "vif*" ip daddr 10.152.152.10 tcp dport 9051 counter redirect to :9051
		iifname "vif*" ip daddr 10.137.0.0/16 tcp dport 9050 counter redirect to :9050
		iifname "vif*" ip daddr 10.138.0.0/16 tcp dport 9050 counter redirect to :9050
		iifname "vif*" ip daddr 10.152.152.10 tcp dport 9050 counter redirect to :9050
		iifname "vif*" ip daddr 10.137.0.0/16 tcp dport 9100 counter redirect to :9100
		iifname "vif*" ip daddr 10.138.0.0/16 tcp dport 9100 counter redirect to :9100
		iifname "vif*" ip daddr 10.152.152.10 tcp dport 9100 counter redirect to :9100
		iifname "vif*" ip daddr 10.137.0.0/16 tcp dport 9101 counter redirect to :9101
		iifname "vif*" ip daddr 10.138.0.0/16 tcp dport 9101 counter redirect to :9101
		iifname "vif*" ip daddr 10.152.152.10 tcp dport 9101 counter redirect to :9101
		iifname "vif*" ip daddr 10.137.0.0/16 tcp dport 9102 counter redirect to :9102
		iifname "vif*" ip daddr 10.138.0.0/16 tcp dport 9102 counter redirect to :9102
		iifname "vif*" ip daddr 10.152.152.10 tcp dport 9102 counter redirect to :9102
		iifname "vif*" ip daddr 10.137.0.0/16 tcp dport 9103 counter redirect to :9103
		iifname "vif*" ip daddr 10.138.0.0/16 tcp dport 9103 counter redirect to :9103
		iifname "vif*" ip daddr 10.152.152.10 tcp dport 9103 counter redirect to :9103
		iifname "vif*" ip daddr 10.137.0.0/16 tcp dport 9104 counter redirect to :9104
		iifname "vif*" ip daddr 10.138.0.0/16 tcp dport 9104 counter redirect to :9104
		iifname "vif*" ip daddr 10.152.152.10 tcp dport 9104 counter redirect to :9104
		iifname "vif*" ip daddr 10.137.0.0/16 tcp dport 9105 counter redirect to :9105
		iifname "vif*" ip daddr 10.138.0.0/16 tcp dport 9105 counter redirect to :9105
		iifname "vif*" ip daddr 10.152.152.10 tcp dport 9105 counter redirect to :9105
		iifname "vif*" ip daddr 10.137.0.0/16 tcp dport 9106 counter redirect to :9106
		iifname "vif*" ip daddr 10.138.0.0/16 tcp dport 9106 counter redirect to :9106
		iifname "vif*" ip daddr 10.152.152.10 tcp dport 9106 counter redirect to :9106
		iifname "vif*" ip daddr 10.137.0.0/16 tcp dport 9107 counter redirect to :9107
		iifname "vif*" ip daddr 10.138.0.0/16 tcp dport 9107 counter redirect to :9107
		iifname "vif*" ip daddr 10.152.152.10 tcp dport 9107 counter redirect to :9107
		iifname "vif*" ip daddr 10.137.0.0/16 tcp dport 9108 counter redirect to :9108
		iifname "vif*" ip daddr 10.138.0.0/16 tcp dport 9108 counter redirect to :9108
		iifname "vif*" ip daddr 10.152.152.10 tcp dport 9108 counter redirect to :9108
		iifname "vif*" ip daddr 10.137.0.0/16 tcp dport 9109 counter redirect to :9109
		iifname "vif*" ip daddr 10.138.0.0/16 tcp dport 9109 counter redirect to :9109
		iifname "vif*" ip daddr 10.152.152.10 tcp dport 9109 counter redirect to :9109
		iifname "vif*" ip daddr 10.137.0.0/16 tcp dport 9110 counter redirect to :9110
		iifname "vif*" ip daddr 10.138.0.0/16 tcp dport 9110 counter redirect to :9110
		iifname "vif*" ip daddr 10.152.152.10 tcp dport 9110 counter redirect to :9110
		iifname "vif*" ip daddr 10.137.0.0/16 tcp dport 9111 counter redirect to :9111
		iifname "vif*" ip daddr 10.138.0.0/16 tcp dport 9111 counter redirect to :9111
		iifname "vif*" ip daddr 10.152.152.10 tcp dport 9111 counter redirect to :9111
		iifname "vif*" ip daddr 10.137.0.0/16 tcp dport 9114 counter redirect to :9114
		iifname "vif*" ip daddr 10.138.0.0/16 tcp dport 9114 counter redirect to :9114
		iifname "vif*" ip daddr 10.152.152.10 tcp dport 9114 counter redirect to :9114
		iifname "vif*" ip daddr 10.137.0.0/16 tcp dport 9115 counter redirect to :9115
		iifname "vif*" ip daddr 10.138.0.0/16 tcp dport 9115 counter redirect to :9115
		iifname "vif*" ip daddr 10.152.152.10 tcp dport 9115 counter redirect to :9115
		iifname "vif*" ip daddr 10.137.0.0/16 tcp dport 9117 counter redirect to :9117
		iifname "vif*" ip daddr 10.138.0.0/16 tcp dport 9117 counter redirect to :9117
		iifname "vif*" ip daddr 10.152.152.10 tcp dport 9117 counter redirect to :9117
		iifname "vif*" ip daddr 10.137.0.0/16 tcp dport 9118 counter redirect to :9118
		iifname "vif*" ip daddr 10.138.0.0/16 tcp dport 9118 counter redirect to :9118
		iifname "vif*" ip daddr 10.152.152.10 tcp dport 9118 counter redirect to :9118
		iifname "vif*" ip daddr 10.137.0.0/16 tcp dport 9122 counter redirect to :9122
		iifname "vif*" ip daddr 10.138.0.0/16 tcp dport 9122 counter redirect to :9122
		iifname "vif*" ip daddr 10.152.152.10 tcp dport 9122 counter redirect to :9122
		iifname "vif*" ip daddr 10.137.0.0/16 tcp dport 9123 counter redirect to :9123
		iifname "vif*" ip daddr 10.138.0.0/16 tcp dport 9123 counter redirect to :9123
		iifname "vif*" ip daddr 10.152.152.10 tcp dport 9123 counter redirect to :9123
		iifname "vif*" ip daddr 10.137.0.0/16 tcp dport 9124 counter redirect to :9124
		iifname "vif*" ip daddr 10.138.0.0/16 tcp dport 9124 counter redirect to :9124
		iifname "vif*" ip daddr 10.152.152.10 tcp dport 9124 counter redirect to :9124
		iifname "vif*" ip daddr 10.137.0.0/16 tcp dport 9125 counter redirect to :9125
		iifname "vif*" ip daddr 10.138.0.0/16 tcp dport 9125 counter redirect to :9125
		iifname "vif*" ip daddr 10.152.152.10 tcp dport 9125 counter redirect to :9125
		iifname "vif*" ip daddr 10.137.0.0/16 tcp dport 9150 counter redirect to :9150
		iifname "vif*" ip daddr 10.138.0.0/16 tcp dport 9150 counter redirect to :9150
		iifname "vif*" ip daddr 10.152.152.10 tcp dport 9150 counter redirect to :9150
		iifname "vif*" ip daddr 10.137.0.0/16 tcp dport 9152-9189 counter redirect
		iifname "vif*" ip daddr 10.138.0.0/16 tcp dport 9152-9189 counter redirect
		iifname "vif*" ip daddr 10.152.152.10 tcp dport 9152-9189 counter redirect
		iifname "vif*" udp dport 53 counter redirect to :5300
		iifname "vif*" tcp flags syn / fin,syn,rst,ack counter redirect to :9040
	}

	chain OUTPUT {
		type nat hook output priority -100; policy accept;
		meta l4proto udp skuid 997 ct state new counter dnat to 127.0.0.1:5400
		meta l4proto tcp skuid 997 ct state new counter dnat to 127.0.0.1:9041
		skuid 104 counter return
		skuid 102 counter return
		skuid 100 counter return
	}
}
# Warning: table ip6 filter is managed by iptables-nft, do not touch!
table ip6 filter {
	chain INPUT {
		type filter hook input priority filter; policy drop;
		counter drop
	}

	chain OUTPUT {
		type filter hook output priority filter; policy drop;
		counter reject
	}

	chain FORWARD {
		type filter hook forward priority filter; policy drop;
		counter reject
	}
}
table ip qubes {
	set downstream {
		type ipv4_addr
		elements = { 10.137.0.68, 10.137.0.84 }
	}

	set allowed {
		type ifname . ipv4_addr
		elements = { "vif9.0" . 10.137.0.68,
			     "vif11.0" . 10.137.0.84 }
	}

	chain prerouting {
		type filter hook prerouting priority raw; policy accept;
		iifgroup 2 goto antispoof
		ip saddr @downstream counter drop
	}

	chain antispoof {
		iifname . ip saddr @allowed accept
		counter drop
	}
}
table ip6 qubes {
	set downstream {
		type ipv6_addr
	}

	set allowed {
		type ifname . ipv6_addr
	}

	chain antispoof {
		iifname . ip6 saddr @allowed accept
		counter drop
	}

	chain prerouting {
		type filter hook prerouting priority raw; policy accept;
		iifgroup 2 goto antispoof
		ip6 saddr @downstream counter drop
	}
}
table inet qubes-nat-accel {
	flowtable qubes-accel {
		hook ingress priority filter
		devices = { eth0, eth1, lo, vif11.0, vif9.0 }
	}

	chain qubes-accel {
		type filter hook forward priority filter + 5; policy accept;
		meta l4proto { tcp, udp } iifgroup 2 oifgroup 1 flow add @qubes-accel
		counter
	}
}
