table ip hy2xs {
  chain input {
    type filter hook input priority 0; policy drop;

    iif lo accept
    ct state established,related accept
    tcp dport {{SSH_PORT}} accept
    udp dport {{HYSTERIA_PORT}} accept
    tcp dport {{UI_PORT}} ip saddr {{UI_BIND_HOST}} accept
    icmp type echo-request accept
  }
}