Экстренный VPN сервер Openconnect с двухфакторной авторизацией на Centos 8

PS: iifname "vpns+" не работает, заметно по счетчикам. Сделал через ip saadr
# nft list table inet filter
table inet filter {
	chain input {
		type filter hook input priority 0; policy drop;
		iif "lo" accept comment "Accept any localhost traffic"
		ct state invalid drop comment "Drop invalid connections"
		ct state established,related accept comment "Accept traffic originated from us"
		icmp type echo-request limit rate over 10/second burst 4 packets drop comment "No ping floods"
		icmpv6 type echo-request limit rate over 10/second burst 4 packets drop comment "No ping floods"
		tcp dport ssh ct state new limit rate 15/minute accept comment "Avoid brute force on SSH"
		meta l4proto { tcp, udp } @th,16,16 25443 accept comment "Accept ocserv"
		tcp dport 28443 accept comment "Accept stunnel"
		tcp dport { http, https } accept
		counter packets 2729 bytes 196569 comment "Count any other traffic"
	}

	chain forward {
		type filter hook forward priority 0; policy drop;
		ct state invalid drop comment "Drop invalid connections"
		ct state established,related accept comment "Accept traffic originated from us"
		iifname "vpns+" counter packets 0 bytes 0 accept
		ip saddr 172.16.1.0/24 accept
	}

	chain output {
		type filter hook output priority 0; policy accept;
	}
}