table inet audit { # handle 1
	set blocklist { # handle 6
		type ipv4_addr
		timeout 1h
	}

	set lans { # handle 7
		type ifname
		elements = { "enp2s0",
			     "enp3s0" }
	}

	chain early { # handle 1
		type filter hook input priority filter - 10; policy accept;
		ip saddr 192.0.2.66 drop comment "an early input chain" # handle 8
	}

	chain input { # handle 2
		type filter hook input priority filter; policy drop;
		ct state established,related accept # handle 9
		ip saddr @blocklist drop comment "dynamic" # handle 10
		iifname @lans accept comment "an interface set" # handle 11
		ip saddr 10.0.0.0/8 ip saddr != 10.0.10.0/24 tcp dport 22 drop comment "two source matches" # handle 12
		icmpv6 type nd-neighbor-solicit ip6 hoplimit != 255 drop comment "hop limit not 255" # handle 13
		iifname "enp2s0.20" udp dport 53 accept comment "DNS from the IoT VLAN" # handle 14
		ip saddr 10.9.0.0/24 jump admin # handle 15
	}

	chain admin { # handle 3
		ip saddr 10.9.0.5 tcp dport 22 accept comment "within the jump" # handle 16
		ip saddr 10.8.0.1 tcp dport 23 accept comment "outside the jump" # handle 17
		meta mark 0x00000001 accept comment "raw under the jump" # handle 18
	}

	chain forward { # handle 4
		type filter hook forward priority filter; policy drop;
		ct state established,related accept # handle 19
		ip daddr 10.0.10.37 tcp dport 443 accept comment "not only forwarded" # handle 20
		iifname "enp2s0" oifname "wan" accept # handle 21
	}

	chain prerouting { # handle 5
		type nat hook prerouting priority dstnat; policy accept;
		ip daddr 203.0.113.1 tcp dport { 80, 443 } dnat ip to 10.0.10.37 comment "web" # handle 23
	}
}