flush ruleset
table inet oci_l4_relay_web_allow {
  counter web_allow_denied {}
  chain ingress {
    type filter hook prerouting priority raw - 20; policy accept;
    fib daddr type local tcp dport { 80, 443, 465, 993 } counter name web_allow_denied drop
  }
}

table inet oci_l4_relay_smtp_deny {
  set denied_v4 {
    type ipv4_addr
    flags interval, timeout
  }
  counter smtp_denied {}
  chain ingress {
    type filter hook prerouting priority raw - 19; policy accept;
    fib daddr type local tcp dport 25 ip saddr @denied_v4 counter name smtp_denied drop
  }
}