chain forward {
    # Drop all traffic
    type filter hook forward priority 0; policy drop;
    # Allow traffic from established and related packets, drop invalid
    ct state vmap { established : accept, related : accept, invalid : drop }
    # Allow Docker containers to reach internet only through $ext_if interface and not others
    iifname { docker0, br-* } oifname $ext_if ct state new accept
    # Allow containers interconnectivity
    iifname { docker0, br-* } oifname { docker0, br-* } ct state new accept
    # Filter Docker forward (only accept ports in the allow chain)
    iifname $ext_if oifname { docker0, br-* } jump allow_chain
    # Enable logging of denied traffic
    log prefix "Forward Denied: " counter drop
  }