op-packages/mwan3-nft/files/lib/mwan3/mwan3-skeleton.nft

# mwan3 nftables framework (v4)
# Standalone ruleset loaded by mwan3's init script via `nft -f` at
# start_service, before mwan3_ensure_nft_framework. Defines mwan3's
# own table (inet mwan3), its six address sets, its hook base chains
# at mangle + 1 priority, and its regular chains.
#
# All runtime content (per-interface mwan3_iface_in_* chains, policy
# chains, sticky-rule chains, setter chains, policy/rule content) is
# added dynamically by the mwan3 shell scripts.
#
# The leading "table inet mwan3" + "delete table inet mwan3" pair is
# the canonical idempotent atomic-replace idiom: the first statement
# ensures the table exists (no-op if already present) so the delete
# can succeed, the second wipes it, and the subsequent definition
# block recreates it fresh. All three statements run as one atomic
# nft transaction inside `nft -f`.

table inet mwan3
delete table inet mwan3

table inet mwan3 {
	# Connected networks (populated by mwan3rtmon and mwan3_set_connected)
	set mwan3_connected_v4 {
		type ipv4_addr
		flags interval
		auto-merge
	}
	set mwan3_connected_v6 {
		type ipv6_addr
		flags interval
		auto-merge
	}

	# Custom routing table networks
	set mwan3_custom_v4 {
		type ipv4_addr
		flags interval
		auto-merge
	}
	set mwan3_custom_v6 {
		type ipv6_addr
		flags interval
		auto-merge
	}

	# Dynamic networks
	set mwan3_dynamic_v4 {
		type ipv4_addr
		flags interval
		auto-merge
	}
	set mwan3_dynamic_v6 {
		type ipv6_addr
		flags interval
		auto-merge
	}

	# Entry point for prerouting
	# priority mangle + 1: runs AFTER fw4's main mangle and after pbr.
	# Order-independence with pbr is achieved by using non-destructive
	# masked save/restore via vmap-dispatch into per-mark OR-immediate
	# setter chains (mwan3_or_meta_*, mwan3_or_ct_*); see common.sh.
	chain mwan3_prerouting {
		type filter hook prerouting priority mangle + 1; policy accept;
	}

	# Entry point for locally-originated traffic
	# type route so mark changes trigger re-routing
	chain mwan3_output {
		type route hook output priority mangle + 1; policy accept;
	}

	# Interface input marking (jumped to from mwan3_prerouting/mwan3_output)
	chain mwan3_ifaces_in {
	}

	# User-defined classification rules
	chain mwan3_rules {
	}

	# Connected/custom/dynamic destination matching
	chain mwan3_connected {
	}
	chain mwan3_custom {
	}
	chain mwan3_dynamic {
	}

	# IPv6 SNAT for router-originated traffic rerouted by mwan3_output. fw4 does
	# not masquerade IPv6 by default, so packets rerouted from WAN-A onto WAN-B
	# would egress with WAN-A's source prefix and be dropped upstream. Opt-in
	# per interface via the 'snat6' UCI option. Per-iface rules are added
	# dynamically by mwan3.sh and only fire when (oif == this WAN) AND
	# (mark == this WAN's mark) AND (saddr is local) AND (saddr != this WAN's
	# IP). Runs at srcnat - 1 so it fires before fw4's srcnat hook.
	chain mwan3_postrouting {
		type nat hook postrouting priority srcnat - 1; policy accept;
	}
}