# Replace the example controller addresses before applying.
# Only Looper ingress is restricted. Existing firewall tables remain intact.
add table inet looper_ingress
add chain inet looper_ingress input { type filter hook input priority -10; policy accept; }
flush chain inet looper_ingress input

add rule inet looper_ingress input iifname "lo" tcp dport { 8765, 8766 } accept
add rule inet looper_ingress input iifname "lo" udp dport 8766 accept
add rule inet looper_ingress input iifname "tailscale0" ip saddr { 100.64.0.10, 100.64.0.11 } tcp dport { 8765, 8766 } accept
add rule inet looper_ingress input iifname "tailscale0" ip saddr { 100.64.0.10, 100.64.0.11 } udp dport 8766 accept
add rule inet looper_ingress input tcp dport { 8765, 8766 } counter drop
add rule inet looper_ingress input udp dport 8766 counter drop