pub fn nftables(spec: &Spec) -> String
The nftables ruleset: forwarding between networks is dropped, except what reach allows (and replies to it).
reach