# RASPBERRY PI 4: /etc/nftables.conf 

table ip nat {
        chain postrouting {
                type nat hook postrouting priority srcnat; policy accept;
                ip saddr 192.168.77.0/24 oifname "usbnet" masquerade
                
                ip saddr 192.168.77.0/24 oifname "wg0" masquerade
        }
}
table inet filter {
        chain input {
                type filter hook input priority filter; policy drop;
                ct state established,related accept
                iifname "lo" accept
                ip protocol icmp accept
                ip6 nexthdr ipv6-icmp accept
                tcp dport 22 accept
                iifname "wlan0" udp dport { 67, 68 } accept
                iifname "wlan0" udp dport 53 accept
                tcp dport 8080 accept
                
                iifname "wg0" accept
        }

        chain forward {
                type filter hook forward priority filter; policy drop;
                iifname "wlan0" oifname "usbnet" accept
                iifname "usbnet" oifname "wlan0" ct state established,related accept
                
                iifname "wlan0" oifname "wg0" accept
                iifname "wg0" oifname "wlan0" ct state established,related accept
        }

        chain output {
                type filter hook output priority filter; policy accept;
        }
}
table ip nm-shared-wlan0 {
        chain nat_postrouting {
                type nat hook postrouting priority srcnat; policy accept;
                ip saddr 192.168.77.0/24 ip daddr != 192.168.77.0/24 masquerade
        }

        chain filter_forward {
                type filter hook forward priority filter; policy accept;
                ip daddr 192.168.77.0/24 oifname "wlan0" ct state { established, related } accept
                ip saddr 192.168.77.0/24 iifname "wlan0" accept
                iifname "wlan0" oifname "wlan0" accept
                iifname "wlan0" reject
                oifname "wlan0" reject
        }
}