{
  pkgs,
  notnft,
  config,
  ...
}: {
  services.ifstate.settings.namespaces.hel = {
    routing.routes = [
      {
        to = "0.0.0.0/0";
        via = "10.0.0.1";
        dev = "dmz";
      }
    ];

    interfaces = [
      {
        name = "dmz";
        link = {
          kind = "veth";
          peer = "hel";
          peer_netns = "dmz";
          state = "up";
        };
        addresses = [
          "10.0.0.2/24"
        ];
      }

      {
        name = "lan";
        link = {
          kind = "bridge";
          state = "up";
        };
        addresses = [
          "10.1.0.2/19"
        ];
      }

      {
        name = "hela";
        link = {
          kind = "veth";
          master = "lan";
          peer = "hel";
          peer_netns = null;
          state = "up";
        };
      }

      # {
      #   name = "wlan0";
      #   link = {
      #     kind = "physical";
      #     permaddr = config.bananapi.ethaddr.wlan0.colon;
      #     master = "lan";
      #     state = "up";
      #   };
      # }

      {
        name = "lan0";
        link = {
          kind = "dsa";
          permaddr = config.bananapi.ethaddr.lan0.colon;
          master = "lan";
          link = "sw";
          link_netns = null;
          state = "up";
        };
      }

      {
        name = "lan1";
        link = {
          kind = "dsa";
          permaddr = config.bananapi.ethaddr.lan1.colon;
          link = "sw";
          link_netns = null;
          master = "lan";
          state = "up";
        };
      }
    ];
  };

  networking.notnft.namespaces.hel.rules =
    # ---
    with notnft.dsl;
    with payload;
    # ---
      ruleset {
        filter = add table {family = f: f.inet;} {
          input =
            add chain {
              type = f: f.filter;
              hook = f: f.input;
              prio = -300;
              policy = f: f.drop;
            }
            [(is.eq ip.saddr (set [(cidr "10.1.0.0/19")])) (is.eq ip.daddr "10.1.0.2") (is.eq ip.protocol (f: f.icmp)) accept]
            # accept related, established and drop invalid
            [
              (vmap ct.state {
                established = accept;
                related = accept;
                invalid = drop;
              })
            ]
            [(is.eq meta.iifname "lo") accept]
            [
              (log {
                prefix = "[drop] hel.input: ";
                queue-threshold = 1;
                group = 2;
              })
            ];

          output = add chain {
            type = f: f.filter;
            hook = f: f.output;
            prio = -300;
            policy = f: f.accept;
          };

          forward =
            add chain {
              type = f: f.filter;
              hook = f: f.forward;
              prio = -300;
              policy = f: f.drop;
            }
            # accept related, established and drop invalid
            [
              (vmap ct.state {
                established = accept;
                related = accept;
                invalid = drop;
              })
            ]
            # accept port forwarding from `dmz` to `lan`
            [
              (is.eq meta.iifname "dmz")
              (is.eq meta.oifname "lan")
              (is."in" ct.status "dnat")
              accept
            ]
            # allow forwarding traffic for the internet
            [
              (is.eq ip.saddr (cidr "10.1.0.0" 19))
              (is.ne ip.daddr (set [
                (cidr "10.0.0.0" 8)
                (cidr "172.16.0.0" 12)
                (cidr "192.168.0.0" 16)
              ]))
              (is.eq meta.iifname "lan")
              (is.eq meta.oifname "dmz")
              accept
            ]
            # allow forwarding icmp pings to local above this one
            [
              (is.eq ip.daddr (cidr "10.0.0.0/24"))
              (is.eq meta.iifname "lan")
              (is.eq meta.oifname "dmz")
              (is.eq ip.protocol (f: f.icmp))
              (is.eq icmp.type (f: f.echo-request))
              accept
            ]
            [
              (log {
                prefix = "[drop] hel.forward: ";
                queue-threshold = 1;
                group = 2;
              })
            ];

          port_dnat =
            add notnft.dsl.map {
              map = f: [f.ipv4_addr f.inet_service];
              type = f: [f.inet_proto f.ipv4_addr f.inet_service];
              flags = f: with f; [interval];
            } [
              [(concat ["udp" "10.0.0.2" 6666]) (concat ["10.1.31.1" 6666])]
              [(concat ["udp" "10.0.0.2" 500]) (concat ["10.1.31.1" 6666])]
              [(concat ["udp" "10.0.0.2" 501]) (concat ["10.1.31.2" 6666])]
              [(concat ["udp" "10.0.0.2" 22]) (concat ["10.1.0.1" 22])]
            ];

          prerouting =
            add chain {
              type = f: f.nat;
              hook = f: f.prerouting;
              prio = -100;
              policy = f: f.accept;
            }
            [
              (dnat.ip {
                addr.map = {
                  key = concat [ip.protocol ip.daddr th.dport];
                  data = "@port_dnat";
                };
              })
            ]
            [
              (is.eq ip.daddr "10.0.0.2")
              (is.eq tcp.dport "22")
              (dnat {
                addr = "10.1.0.1";
                port = "22";
              })
            ];

          postrouting =
            add chain {
              type = f: f.nat;
              hook = f: f.postrouting;
              prio = -100;
              policy = f: f.accept;
            }
            [
              (is.eq meta.oifname "dmz")
              masquerade
            ];
        };
      };

  systemd.services.ulogd-hel = {
    description = "Ulogd Daemon";
    wantedBy = ["multi-user.target"];
    wants = ["network-pre.target"];
    before = ["network-pre.target"];
    after = ["ifstate.service"];

    serviceConfig = let
      settingsFormat = pkgs.formats.ini {listsAsDuplicateKeys = true;};
      settingsFile = settingsFormat.generate "ulogd.conf" {
        # This one for logging to local file in emulated syslog format.
        global.stack = "log2:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,print1:PRINTPKT,emu1:LOGEMU";

        log2.group = 2;

        emu1 = {
          file = "/var/log/nft_hel_drop.log";
          sync = 1;
        };
      };
    in {
      NetworkNamespacePath = "/var/run/netns/hel";
      ExecStart = "${pkgs.ulogd}/bin/ulogd -c ${settingsFile} --verbose --loglevel ${
        toString 5
      }";
      ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
    };
  };
}