table inet hy2xs {
  chain input {
    type filter hook input priority 0; policy drop;

    iif lo accept
    ct state established,related accept
    meta nfproto ipv4 tcp dport {{SSH_PORT}} accept
    {{ACME_RULE}}
    meta nfproto ipv4 udp dport {{HYSTERIA_PORT}} accept
    meta nfproto ipv4 icmp type echo-request accept
  }
}