1iptables-translate -A FORWARD -p esp -j ACCEPT 2nft 'add rule ip filter FORWARD ip protocol esp counter accept' 3 4iptables-translate -A INPUT --in-interface wan --protocol esp -j ACCEPT 5nft 'add rule ip filter INPUT iifname "wan" ip protocol esp counter accept' 6 7iptables-translate -A INPUT -p 50 -m esp --espspi 500 -j DROP 8nft 'add rule ip filter INPUT esp spi 500 counter drop' 9 10iptables-translate -A INPUT -p 50 -m esp --espspi 500:600 -j DROP 11nft 'add rule ip filter INPUT esp spi 500-600 counter drop' 12 13iptables-translate -A INPUT -p 50 -m esp --espspi 0:4294967295 -j DROP 14nft 'add rule ip filter INPUT meta l4proto esp counter drop' 15 16iptables-translate -A INPUT -p 50 -m esp ! --espspi 0:4294967295 -j DROP 17nft 'add rule ip filter INPUT esp spi != 0-4294967295 counter drop' 18 19ip6tables-translate -A INPUT -p 50 -m esp --espspi 0:4294967295 -j DROP 20nft 'add rule ip6 filter INPUT exthdr esp exists counter drop' 21 22ip6tables-translate -A INPUT -p 50 -m esp ! --espspi 0:4294967295 -j DROP 23nft 'add rule ip6 filter INPUT esp spi != 0-4294967295 counter drop' 24