table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;

        iifname "lo" accept
        ct state established,related accept
        ct state invalid drop

        iifname "eth0" ip saddr 10.0.0.0/8 drop
        iifname "eth0" ip saddr 172.16.0.0/12 drop
        iifname "eth0" ip saddr 192.168.0.0/16 drop

        tcp dport 22 ct state new limit rate 3/minute burst 5 packets accept
        tcp dport { 80, 443 } accept
        tcp dport 8080 accept
        udp dport 53 accept
        tcp dport 53 accept
        udp dport 123 accept

        icmp type echo-request limit rate 1/second burst 5 packets accept
        icmp type { echo-reply, destination-unreachable, time-exceeded } accept

        ip saddr 203.0.113.0/24 tcp dport 3306 accept
        ip saddr 198.51.100.10 tcp dport 5432 accept

        limit rate 5/minute log prefix "DROPPED: "
        drop
    }

    chain forward {
        type filter hook forward priority 0; policy drop;

        ct state established,related accept
        drop
    }

    chain output {
        type filter hook output priority 0; policy accept;
    }
}

table inet nat {
    chain postrouting {
        type nat hook postrouting priority 100;

        oifname "eth0" masquerade
    }

    chain prerouting {
        type nat hook prerouting priority -100;

        iifname "eth0" tcp dport 8443 dnat to 10.0.1.5:443
    }
}