nft-blackhole.template

table inet blackhole {
        set whitelist-v4 {
                type ipv4_addr
                flags interval
                auto-merge
        }

        set whitelist-v6 {
                type ipv6_addr
                flags interval
                auto-merge
        }

        set blacklist-v4 {
                type ipv4_addr
                flags interval
                auto-merge
        }

        set blacklist-v6 {
                type ipv6_addr
                flags interval
                auto-merge
        }

        set country-v4 {
                type ipv4_addr
                flags interval
                auto-merge
        }

        set country-v6 {
                type ipv6_addr
                flags interval
                auto-merge
        }

        chain input {
                type filter hook input priority -1; policy ${default_policy};
                iifname lo accept
                ct state established,related accept
                ip saddr @whitelist-v4 counter accept
                ip6 saddr @whitelist-v6 counter accept
                ip saddr @blacklist-v4 counter ${block_policy}
                ip6 saddr @blacklist-v6 counter ${block_policy}
                ${country_ex_ports_rule}
                ip saddr @country-v4 counter ${country_policy}
                ip6 saddr @country-v6 counter ${country_policy}
                counter
        }

        ${chain_output}

        ${chain_forward}
}