table ip hy2xs {
  chain input {
    type filter hook input priority 0; policy drop;

    iif lo accept
    ct state established,related accept
    tcp dport {{SSH_PORT}} accept
    {{ACME_RULE}}
    udp dport {{HYSTERIA_PORT}} accept
    icmp type echo-request accept
  }
}