new_chain	filter DFWRS_FORWARD
flush_chain	filter DFWRS_FORWARD
new_chain	filter DFWRS_INPUT
flush_chain	filter DFWRS_INPUT
new_chain	nat DFWRS_PREROUTING
flush_chain	nat DFWRS_PREROUTING
new_chain	nat DFWRS_POSTROUTING
flush_chain	nat DFWRS_POSTROUTING
append	filter DFWRS_INPUT -m state --state INVALID -j DROP
append	filter DFWRS_INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
append_replace	filter INPUT -j DFWRS_INPUT
append	filter DFWRS_FORWARD -m state --state INVALID -j DROP
append	filter DFWRS_FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
append_replace	filter FORWARD -j DFWRS_FORWARD
append_replace	nat PREROUTING -j DFWRS_PREROUTING
append_replace	nat POSTROUTING -j DFWRS_POSTROUTING
append	filter DFWRS_FORWARD -d $dst_ip=ip -i eni -o $output=bridge -p tcp --dport 80 -j ACCEPT
append	nat DFWRS_PREROUTING -i eni -p tcp --dport 80 -j DNAT --to-destination ${dst_ip=ip}:80
append	filter DFWRS_FORWARD -d $dst_ip=ip -i eni -o $output=bridge -p tcp --dport 80 -j ACCEPT
append	nat DFWRS_PREROUTING -i eni -p tcp --dport 80 -j DNAT --to-destination ${dst_ip=ip}:80
append	filter DFWRS_FORWARD -d $dst_ip=ip -i eni -o $output=bridge -p udp --dport 53 -j ACCEPT
append	nat DFWRS_PREROUTING -i eni -p udp --dport 53 -j DNAT --to-destination ${dst_ip=ip}:53
append	filter DFWRS_FORWARD -d $dst_ip=ip -i other -o $output=bridge -p tcp --dport 443 -j ACCEPT
append	nat DFWRS_PREROUTING -i other -p tcp --dport 443 -j DNAT --to-destination ${dst_ip=ip}:443
append	filter DFWRS_FORWARD -i docker0 -o eni -j ACCEPT
append	filter DFWRS_INPUT -i docker0 -j ACCEPT
append	nat DFWRS_POSTROUTING -o eni -j MASQUERADE
commit
