1iptables-translate -A FORWARD -p esp -j ACCEPT 2nft add rule ip filter FORWARD ip protocol esp counter accept 3 4iptables-translate -A INPUT --in-interface wan --protocol esp -j ACCEPT 5nft add rule ip filter INPUT iifname "wan" ip protocol esp counter accept 6 7iptables-translate -A INPUT -p 50 -m esp --espspi 500 -j DROP 8nft add rule ip filter INPUT esp spi 500 counter drop 9 10iptables-translate -A INPUT -p 50 -m esp --espspi 500:600 -j DROP 11nft add rule ip filter INPUT esp spi 500-600 counter drop 12