table inet filter {
    chain ncsi_input {
        type filter hook input priority 0; policy drop;
        iifname != @NCSI_IF@ accept
        ct state established accept
        tcp dport 3959 accept
        udp dport 3959 accept
        tcp dport 3967 accept
        udp dport 3967 accept
        icmpv6 type nd-neighbor-advert accept
        icmpv6 type nd-neighbor-solicit accept
        icmpv6 type nd-router-advert accept
    }
}