table inet main { # handle 3
	map portforwards { # handle 4
		type inet_service : ipv4_addr . inet_service
		elements = { 80 : 192.168.1.50 . 8080,
			     443 : 192.168.1.50 . 443 }
	}

	map hosts { # handle 5
		type inet_service : ipv4_addr
		elements = { 2222 : 192.168.1.60 }
	}

	map lan_services { # handle 6
		type inet_service : verdict
		elements = { 22 : accept,
			     23 : drop,
			     80 : jump web }
	}

	map pairs { # handle 7
		type ipv4_addr . inet_service : verdict
		elements = { 192.168.1.9 . 22 : accept }
	}

	chain web { # handle 1
		ip saddr 192.168.1.0/24 accept # handle 8
	}

	chain prerouting { # handle 2
		type nat hook prerouting priority dstnat; policy accept;
		iifname "wan" dnat ip to tcp dport map @portforwards comment "Port forwards" # handle 9
		iifname "wan" dnat ip to tcp dport map @hosts # handle 10
		iifname "wan" dnat ip to udp dport map { 5000 : 192.168.1.70 . 5001, 6000 : 192.168.1.71 . 6000 } # handle 12
	}

	chain input { # handle 3
		type filter hook input priority filter; policy drop;
		ct state established,related accept # handle 13
		iifname "lan" tcp dport vmap @lan_services # handle 14
		iifname "wan" udp dport vmap { 53 : accept, 123 : drop } # handle 16
		ip saddr vmap { 10.0.0.0/8 : accept, 192.0.2.1 : drop } # handle 18
		ip saddr . tcp dport vmap @pairs # handle 19
	}
}