table ip nexusguard {
	chain forward {
		type filter hook forward priority filter; policy accept;
		ct state established,related accept comment "fwd_estab"
		ip saddr 10.172.21.2 ip daddr 10.172.21.0/24 accept comment "peer_gogo2"
		ip saddr 10.172.21.3 ip daddr 10.172.21.0/24 accept comment "peer_gogo3"
		ip saddr 10.172.21.0/24 drop comment "wg_isolation_default"
	}
}

# Rule counts:
#   total = 4
#   peer_ = 2 (peer_gogo2, peer_gogo3)
#   fwd_estab = 1
#   wg_isolation_default = 1
#   duplicates: NONE (verified via `sort | uniq -c`)
#
# Rule order: CORRECT (fwd_estab first for fast-path, wg_isolation last for default drop)
# Persistence: STABLE (no process re-adding rules; verified across 30s window)