domain (ip ip6) {
  table filter {
    chain INPUT {
      policy DROP;

      # connection tracking
      mod state state INVALID DROP;
      mod state state (ESTABLISHED RELATED) ACCEPT;

      # allow local packet
      interface lo ACCEPT;

      # respond to ping
      proto icmp ACCEPT;

      # allow ipv6 dhcp
      proto udp saddr fe80::/10 daddr fe80::/10 sport 547 dport 546 ACCEPT;

      # allow SSH connections
      proto tcp dport ssh ACCEPT;
      # web
      proto tcp mod multiport destination-ports (http https) ACCEPT;
    }

    chain OUTPUT {
      policy ACCEPT;
    }

    # enable forwarding from veth+
    chain FORWARD {
      policy ACCEPT;
    }
  }

  # enable masquerading from veth+
  table nat {
    chain POSTROUTING {
      saddr 10.0.0.0/8 MASQUERADE;
    }
  }
}
