#!/usr/sbin/nft -f

flush ruleset

table inet filter {

    chain input {
        type filter hook input priority 0;
        policy accept;
    }

    chain forward {
        type filter hook forward priority 0;
        policy accept;

        # Permite pacotes de conexões já estabelecidas
        ct state established,related accept

        # Permite a rede LAB acessar a Internet
        iifname "enp0s8" oifname "enp0s3" accept
    }

    chain output {
        type filter hook output priority 0;
        policy accept;
    }
}

table ip nat {

    chain postrouting {
        type nat hook postrouting priority srcnat;
        policy accept;

        # NAT da rede LAB para a Internet
        oifname "enp0s3" ip saddr 172.17.0.0/24 masquerade
    }


	chain PREROUTING {
		type nat hook prerouting priority dstnat; policy accept;
		ip saddr 192.168.56.1 ip daddr 192.168.56.100 tcp dport 10001 counter packets 0 bytes 0 dnat to 172.17.0.2:22
	}
}