table inet filter { chain ssh_input { } chain wan_input { tcp dport vmap { 22 : jump ssh_input } } chain prerouting { type filter hook prerouting priority raw; policy accept; iif vmap { "lo" : jump wan_input } } }