stream {
	server {
		listen 37.143.117.109:443;

		resolver [2001:148f:ffff::1] ipv4=off;
		ssl_preread on;

		proxy_bind 64:ff9b:1::$remote_addr transparent;
		proxy_pass $ssl_preread_server_name:$server_port;
	}
}

table ip6 filter {
	# ...
	chain forward_from_untrusted {
		# Here are forwards from stuff like WAN
	}

	chain output {
		type filter hook output priority filter
		policy accept

		ip6 saddr 64:ff9b:1::/96 goto nat46_forward
	}

	chain nat46_forward {
		jump forward_from_untrusted
		reject with icmpv6 type admin-prohibited
	}
}