#!/bin/bash

set -e

RULESET="table ip x {
        map y {
                typeof tcp flags : verdict
                flags interval
                elements = { syn | ack : accept,
                             ack : drop,
                             rst : drop,
                             0x20-0xff : drop,
		}
        }

        set s {
                typeof tcp flags
                flags interval
                elements = { syn | ack,
                             ack,
			     rst,
			     0x20-0xff,
		}
        }


        chain z {
                tcp flags vmap @y
                tcp flags vmap { syn | ack : accept, ack : drop, rst : drop, 0x20-0xff : drop }
                tcp flags @s
                tcp flags { syn | ack, ack, rst, 0x20-0xff }
        }
}"

$NFT -f - <<< $RULESET
