#!/usr/sbin/nft -f
# van-router NAT — masquerade LAN out whatever the WAN of the moment is
# (anything that is NOT the LAN bridge br0: ethernet/Starlink, wifi, future 4G).
# ZeroTier (ztuga7c2kh) is excluded too: it is a routed overlay, so van hosts keep
# their real 10.42.x source addresses there instead of all appearing as the van's ZT IP.
table ip van_router_nat
delete table ip van_router_nat
table ip van_router_nat {
    chain postrouting {
        type nat hook postrouting priority srcnat; policy accept;
        ip saddr @GATEWAY_NETWORK@ oifname != { "br0", "ztuga7c2kh" } masquerade;
    }
}