table inet filter {

  set asn_deny_v4 {
    type ipv4_addr
    flags interval, timeout
    timeout 7d
    auto-merge
  }

  chain input {
    type filter hook input priority 0;
    policy drop;

    ct state established,related accept
    iif lo accept

    # Public: only HTTP/HTTPS
    tcp dport {80,443} accept

    # ASN TTL drop (optional)
    ip saddr @asn_deny_v4 drop

    reject with icmpx type port-unreachable
  }
}