table inet main { # handle 1
	set ssh_meter { # handle 4
		type ipv4_addr
		size 65535
		flags dynamic,timeout
		timeout 1m
	}

	set ssh6_meter { # handle 5
		type ipv6_addr
		size 65535
		flags dynamic,timeout
		timeout 1m
	}

	set my_connlimit { # handle 6
		type ipv4_addr
		size 65535
		flags dynamic
	}

	set guest_quota { # handle 7
		type ipv4_addr
		size 65535
		flags dynamic
	}

	set trusted { # handle 8
		type ipv4_addr
		flags interval
		elements = { 10.0.10.0/24 }
	}

	chain input { # handle 1
		type filter hook input priority filter; policy drop;
		ct state established,related accept # handle 9
		tcp dport 22 ct state new update @ssh_meter { ip saddr limit rate over 3/minute burst 5 packets } counter packets 0 bytes 0 drop # handle 10
		tcp dport 22 ct state new update @ssh6_meter { ip6 saddr & ffff:ffff:ffff:ffff:: limit rate over 3/minute burst 5 packets } counter packets 0 bytes 0 drop # handle 11
		ip saddr @trusted tcp dport 22 accept # handle 12
	}

	chain forward { # handle 2
		type filter hook forward priority filter; policy drop;
		ct state new add @my_connlimit { ip saddr ct count over 20 } counter packets 0 bytes 0 drop # handle 13
		iifname "lan" oifname "wan" limit rate over 10 mbytes/second burst 512 kbytes drop # handle 14
		iifname "guest0" oifname "wan" add @guest_quota { ip saddr & 255.255.255.0 quota over 1000 mbytes } drop # handle 15
		iifname "lan" oifname "wan" quota over 100000 mbytes drop # handle 16
		iifname "lan" oifname "wan" accept # handle 17
	}

	chain output { # handle 3
		type filter hook output priority filter; policy accept;
	}
}