table inet openshift-block-output {
	chain block {
		tcp dport { 22623, 22624 } tcp flags syn / fin,syn,rst,ack reject
		ip daddr 169.254.169.254 udp dport != 53 reject with icmp port-unreachable
		ip daddr 169.254.169.254 tcp dport != 53 reject with icmp port-unreachable
	}

	chain output {
		type filter hook output priority filter; policy accept;
		goto block
	}

	chain forward {
		type filter hook forward priority filter; policy accept;
		goto block
	}
}
table ip nat {
	chain prerouting {
		type nat hook prerouting priority dstnat; policy accept;
		iifname "eth0" counter packets 2 bytes 120 jump KUBEVIRT_PREINBOUND
	}

	chain input {
		type nat hook input priority srcnat; policy accept;
	}

	chain output {
		type nat hook output priority dstnat; policy accept;
		ip daddr 127.0.0.1 counter packets 0 bytes 0 dnat to 10.0.2.2
	}

	chain postrouting {
		type nat hook postrouting priority srcnat; policy accept;
		ip saddr 10.0.2.2 counter packets 133 bytes 10128 masquerade
		oifname "k6t-eth0" counter packets 3 bytes 638 jump KUBEVIRT_POSTINBOUND
	}

	chain KUBEVIRT_PREINBOUND {
		counter packets 2 bytes 120 dnat to 10.0.2.2
	}

	chain KUBEVIRT_POSTINBOUND {
		ip saddr 127.0.0.1 counter packets 0 bytes 0 snat to 10.0.2.1
	}
}
table ip6 nat {
	chain prerouting {
		type nat hook prerouting priority dstnat; policy accept;
		iifname "eth0" counter packets 0 bytes 0 jump KUBEVIRT_PREINBOUND
	}

	chain input {
		type nat hook input priority srcnat; policy accept;
	}

	chain output {
		type nat hook output priority dstnat; policy accept;
		ip6 daddr ::1 counter packets 0 bytes 0 dnat to fd10:0:2::2
	}

	chain postrouting {
		type nat hook postrouting priority srcnat; policy accept;
		ip6 saddr fd10:0:2::2 counter packets 0 bytes 0 masquerade
		oifname "k6t-eth0" counter packets 0 bytes 0 jump KUBEVIRT_POSTINBOUND
	}

	chain KUBEVIRT_PREINBOUND {
		counter packets 0 bytes 0 dnat to fd10:0:2::2
	}

	chain KUBEVIRT_POSTINBOUND {
		ip6 saddr ::1 counter packets 0 bytes 0 snat to fd10:0:2::1
	}
}
