destroy table inet lisglosips_filter

table inet lisglosips_filter {
    set admin_ipv4 {
        type ipv4_addr
        elements = { 100.91.249.119, 100.98.167.119 }
    }

    chain input {
        type filter hook input priority 10; policy drop;

        ct state invalid counter drop
        ct state established,related counter accept
        iifname "lo" counter accept

        ip protocol icmp counter accept
        ip6 nexthdr ipv6-icmp counter accept

        udp dport 41641 counter accept comment "Tailscale direct transport"

        iifname "tailscale0" ip saddr @admin_ipv4 tcp dport { 22, 443 } counter accept comment "Admin SSH and HTTPS"
        iifname "tailscale0" ip saddr 100.90.90.90 tcp dport 6379 counter accept comment "Server A to Redis"
        iifname "tailscale0" ip saddr 100.90.90.90 udp dport 9060 counter accept comment "Server A to HEP"

        counter drop
    }
}