define nic = eth0

flush ruleset

table inet nat-n-filter {
	#
	# inbound
	#
	chain prerouting {
		type nat hook prerouting priority dstnat;

		ip protocol icmp accept
		ip6 nexthdr ipv6-icmp accept

		# v4 specific
		iif $nic ip saddr 0.0.0.0/0 tcp dport 2222 dnat 10.0.0.22:22

		# both v4 and v6
		iif $nic tcp dport 22 accept

		iif $nic ct state established accept
		iif $nic reject
	}

	#
	# outbound
	#
        chain postrouting {
                type nat hook postrouting priority srcnat;

		# v4 specific
                oif $nic ip saddr 10.0.0.0/24 snat 192.168.122.21
        }
}