#!/usr/sbin/nft -f
# van-router NAT — masquerade LAN out whatever the WAN of the moment is
# (anything that is NOT the LAN bridge br0: ethernet/Starlink, wifi, future 4G)
table ip van_router_nat
delete table ip van_router_nat
table ip van_router_nat {
    chain prerouting {
        type nat hook prerouting priority dstnat; policy accept;
        # Expose the Home Assistant VM (on libvirt's NAT net, 192.168.122.50) on the
        # router's own LAN IP, so VanLink clients reach it at http://10.42.0.1:8123.
        # The matching FORWARD accept lives in iptables (re-applied by the libvirt
        # /etc/libvirt/hooks/network hook), since libvirt's reject is in that chain.
        ip daddr 10.42.0.1 tcp dport 8123 dnat to 192.168.122.50:8123
    }
    chain postrouting {
        type nat hook postrouting priority srcnat; policy accept;
        ip saddr 10.42.0.0/24 oifname != "br0" masquerade
        # ZeroTier clients reaching the HA VM via the 10.42.0.1:8123 DNAT: masquerade
        # them onto virbr0 so HA sees the router (192.168.122.1) and the reply path is
        # symmetric, exactly like VanLink clients. Matched by ZT ingress interface so it
        # covers direct members (192.168.196.x) AND the LAN subnets routed in behind other
        # ZT nodes (192.168.0/6/8/10/13.x). Scoped to virbr0 so ZT<->ZT and ZT->WAN are
        # untouched.
        iifname "ztuga7c2kh" oifname "virbr0" masquerade
    }
}