root@mmc-backend:/var/www/mmc_moscow_terminal/dev# nft list ruleset

table ip nat {

        chain dstnat {

                type nat hook prerouting priority 50; policy accept;

        }

        chain srcnat {

                type nat hook postrouting priority 50; policy accept;

                oifname "eth0" counter packets 1598271 bytes 97991181 masquerade

        }

}

table inet filter {

        set f2b-sshd {

                type ipv4_addr

                elements = { 14.238.90.66, 31.94.32.127,

                             46.101.248.68, 59.120.184.126,

                             59.126.140.155, 122.175.4.186,

                             143.110.220.40, 152.32.150.45,

                             172.86.127.253, 203.172.41.149,

                             206.81.9.31, 212.68.38.179 }

        }

        chain forward {

                type filter hook forward priority 50; policy accept;

                ct state { established, related } counter packets 0 bytes 0 accept

        }

        chain input {

                type filter hook input priority 50; policy accept;

                tcp dport { ssh } ip saddr @f2b-sshd reject

                tcp dport { http, https } ip saddr { 79.143.19.73, 79.143.19.177, 109.172.110.191, 109.172.112.150 } counter packets 20556 bytes 1233108 reject with icmp type net-prohibited                iifname "lo" accept

                icmp type echo-reply counter packets 1 bytes 84 accept

                icmp type echo-request counter packets 56405 bytes 2288309 accept

                ct state { established, related } counter packets 1137340450 bytes 1785291005800 accept                ct state invalid counter packets 2065973 bytes 125911587 drop

                tcp dport ssh counter packets 51000 bytes 2996702 accept comment "ssh"

                oifname "eth0" iifname "eth0" ct state { established, related } counter packets 0 bytes 0 accept

                iifname "eth0" ip saddr { 5.9.163.66, 10.0.0.0/8, 37.230.113.32, 46.41.91.12, 95.84.156.100, 127.0.0.1, 158.160.24.106, 178.154.235.183, 185.12.125.139, 188.255.21.60 } counter packets 3245 bytes 207250 accept                oifname "eth0" ip daddr { 5.9.163.66, 10.0.0.0/8, 37.230.113.32, 46.41.91.12, 95.84.156.100, 127.0.0.1, 158.160.24.106, 178.154.235.183, 185.12.125.139, 188.255.21.60 } counter packets 0 bytes 0 accept

                iifname "eth0" tcp dport http counter packets 6746 bytes 368886 accept

                oifname "eth0" tcp sport http counter packets 0 bytes 0 accept

                iifname "eth0" tcp dport https counter packets 6624128 bytes 501268067 accept

                oifname "eth0" tcp sport https counter packets 0 bytes 0 accept

                tcp dport mysql ip saddr { 5.9.163.66, 10.0.0.0/8, 37.230.113.32, 46.41.91.12, 95.84.156.100, 127.0.0.1, 158.160.24.106, 178.154.235.183, 185.12.125.139, 188.255.21.60 } counter packets 0 bytes 0 accept

                tcp sport mysql ip daddr { 5.9.163.66, 10.0.0.0/8, 37.230.113.32, 46.41.91.12, 95.84.156.100, 127.0.0.1, 158.160.24.106, 178.154.235.183, 185.12.125.139, 188.255.21.60 } counter packets 2 bytes 96 accept

                tcp dport mysql counter packets 4762 bytes 252536 accept

                tcp sport mysql counter packets 0 bytes 0 accept

                meta l4proto tcp iifname "eth0" meta nfproto ipv4 ip saddr 8.0.0.0/8 counter packets 1017 bytes 44652 reject with tcp reset        }

        chain ouput {

                type filter hook input priority 50; policy accept;

                oifname "eth0" ct state { established, related } counter packets 0 bytes 0 accept

        }

}