#!/usr/sbin/nft -f table inet filter { chain input { tcp dport 5900 accept comment "accept VNC" } }