[Unit]
Before=network-pre.target

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/libexec/nft-configure.sh
ExecStop=/usr/sbin/nft flush ruleset

[Install]
WantedBy=multi-user.target