table ip filter {
	chain INPUT {
		type filter hook input priority filter; policy drop;
		ct state invalid counter drop
		ct state invalid counter drop
		meta l4proto tcp tcp flags & (fin|syn|rst|psh|ack|urg) == fin|syn|rst|ack counter drop
		meta l4proto tcp tcp flags & (fin|syn) == fin|syn counter drop
		meta l4proto tcp tcp flags & (syn|rst) == syn|rst counter drop
		ip frag-off & 8191 != 0 counter drop
		meta l4proto tcp tcp flags & (fin|syn|rst|psh|ack|urg) == fin|syn|rst|psh|ack|urg counter drop
		meta l4proto tcp tcp flags & (fin|syn|rst|psh|ack|urg) == 0x0 counter drop
		iifname "lo" counter accept
		ct state established counter accept
		iifname "tun0" counter accept
		meta l4proto tcp counter reject with tcp reset
		counter reject
	}

	chain FORWARD {
		type filter hook forward priority filter; policy drop;
		counter drop
	}

	chain OUTPUT {
		type filter hook output priority filter; policy drop;
		ct state invalid counter reject with icmp type admin-prohibited
		ct state invalid counter reject with icmp type admin-prohibited
		meta l4proto tcp tcp flags & (fin|syn|rst|psh|ack|urg) == fin|syn|rst|ack counter reject with icmp type admin-prohibited
		meta l4proto tcp tcp flags & (fin|syn) == fin|syn counter reject with icmp type admin-prohibited
		meta l4proto tcp tcp flags & (syn|rst) == syn|rst counter reject with icmp type admin-prohibited
		ip frag-off & 8191 != 0 counter reject with icmp type admin-prohibited
		meta l4proto tcp tcp flags & (fin|syn|rst|psh|ack|urg) == fin|syn|rst|psh|ack|urg counter reject with icmp type admin-prohibited
		meta l4proto tcp tcp flags & (fin|syn|rst|psh|ack|urg) == 0x0 counter reject with icmp type admin-prohibited
		oifname "lo" counter accept
		oifname "tun0" counter accept
		skuid 105 counter accept
		skuid 107 ip daddr 127.0.0.1-127.0.0.1 counter accept
		skuid 107 ip daddr 10.137.0.83-10.137.0.83 counter accept
		skuid 107 ip daddr 10.152.152.10-10.152.152.10 counter accept
	}
}
table ip6 filter {
	chain INPUT {
		type filter hook input priority filter; policy drop;
		iifname "lo" counter accept
		counter drop
	}

	chain OUTPUT {
		type filter hook output priority filter; policy drop;
		oifname "lo" counter accept
		counter reject
	}

	chain FORWARD {
		type filter hook forward priority filter; policy drop;
		counter drop
	}
}
