table ip x { chain y { type filter hook input priority 0; policy drop; } }