*filter
:INPUT DROP [0:0]
...
:f2b-sshd - [0:0]
...
-A INPUT -i lo -j ACCEPT
-A INPUT -s <LAN IP>/24 -j ACCEPT
-A INPUT -s 10.9.9.0/24 -j ACCEPT
...
-A INPUT -p udp -m udp --dport 4500 -j ACCEPT
...
-A INPUT -j whitelist
-A INPUT -p tcp -m multiport --dports 22 -j f2b-sshd
...
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.9.9.0/24 -d <LAN IP> -o eth0 -m conntrack --ctstate NEW -j ACCEPT
...
-A f2b-sshd -j RETURN
...
COMMIT
*nat
...
-A POSTROUTING -s 10.9.9.0/24 -o eth0 -j MASQUERADE
...
COMMIT