table inet fw4
flush table inet fw4
delete flowtable inet fw4 ft

table inet fw4 {
        #
        # Flowtable
        #

        flowtable ft {
                hook ingress priority 0;
                devices = { "eth0", "eth1", "eth2", "wlan0", "wlan1", "wlan1-1" };
        }


        #
        # CT helper definitions
        #

        ct helper amanda {
                type "amanda" protocol udp;
        }

        ct helper RAS {
                type "RAS" protocol udp;
        }

        ct helper Q.931 {
                type "Q.931" protocol tcp;
        }

        ct helper irc {
                type "irc" protocol tcp;
        }

        ct helper pptp {
                type "pptp" protocol tcp;
        }

        ct helper sip {
                type "sip" protocol udp;
        }

        ct helper snmp {
                type "snmp" protocol udp;
        }

        ct helper tftp {
                type "tftp" protocol udp;
        }


        #
        # Defines
        #

        define lan_devices = { "br-lan" }
        define lan_subnets = { 192.168.1.0/24 }

        define wan_devices = { "eth0.2", "eth2" }
        define wan_subnets = { 85.xxx.xxx.0/24, 192.168.8.0/24 }

        define dmz_devices = { "eth1.3" }
        define dmz_subnets = { 172.16.1.0/29 }

        define guest_devices = { "br-guest" }
        define guest_subnets = { 10.0.1.0/29 }


        #
        # User includes
        #

        include "/etc/nftables.d/*.nft"


        #
        # Filter rules
        #

        chain input {
        }

        chain forward {
        }

        chain output {
        }

        chain prerouting {
        }

        chain handle_reject {
        }

        chain syn_flood {
        }

        chain input_lan {
        }

        chain output_lan {
        }

        chain forward_lan {
        }

        chain helper_lan {
        }

        chain accept_from_lan {
        }

        chain accept_to_lan {
        }

        chain input_wan {
        }

        chain output_wan {
        }

        chain forward_wan {
        }

        chain accept_to_wan {
        }

        chain reject_from_wan {
        }

        chain reject_to_wan {
        }

        chain input_dmz {
        }

        chain output_dmz {
        }

        chain forward_dmz {
        }

        chain helper_dmz {
        }

        chain accept_to_dmz {
        }

        chain reject_from_dmz {
        }

        chain reject_to_dmz {
        }

        chain input_guest {
        }

        chain output_guest {
        }

        chain forward_guest {
        }

        chain helper_guest {
        }

        chain accept_to_guest {
        }

        chain reject_from_guest {
        }

        chain reject_to_guest {
                oifname "br-guest" counter jump handle_reject comment "!fw4: reject guest IPv4/IPv6 traffic"
        }


        #
        # NAT rules
        #

        chain dstnat {
        }

        chain srcnat {
        }

        chain dstnat_wan {
        }

        chain srcnat_wan {
        }

        chain dstnat_dmz {
        }

        chain srcnat_dmz {
        }


        #
        # Raw rules (notrack)
        #

        chain raw_prerouting {
        }

        chain raw_output {
        }


        #
        # Mangle rules
        #

        chain mangle_prerouting {
        }

        chain mangle_postrouting {
        }

        chain mangle_input {
        }

        chain mangle_output {
        }

        chain mangle_forward {
        }
}

root@openwrt:~# nft insert rule ip filter input iifname "eth1.3" ip daddr 192.168.
1.1 tcp dport 22 counter reject
Error: No such file or directory; did you mean table ‘fw4’ in family inet?
insert rule ip filter input iifname eth1.3 ip daddr 192.168.1.1 tcp dport 22 counter reject
               ^^^^^^
root@openwrt:~# nft insert rule ip filter input_dmz iifname "eth1.3" ip daddr 192.
168.1.1 tcp dport 22 counter reject
Error: No such file or directory; did you mean table ‘fw4’ in family inet?
insert rule ip filter input_dmz iifname eth1.3 ip daddr 192.168.1.1 tcp dport 22 counter reject
               ^^^^^^

        chain forward_lan {
                oifname "eth1.3" ip daddr 172.16.25.2 tcp dport 53 counter jump accept_to_dmz comment "!fw4: RPi4_DNS_in"
                jump accept_to_wan comment "!fw4: Accept lan to wan forwarding"
                jump accept_to_lan
        }
        
        chain forward_dmz {
                iifname "eth1.3" ip saddr 172.16.25.2 udp sport 53 counter jump accept_to_lan comment "!fw4: RPi4_DNS_out"
                ct status dnat accept comment "!fw4: Accept port forwards"
                jump reject_to_dmz
        }

nft insert rule ip filter inet fw4 iifname "br-lan" oifname "eth1.3" ip saddr 192.168.1.0/24 ip daddr 172.16.1.2 tcp dport 53 counter accept
nft insert rule ip filter inet fw4 iifname "eth1.3" oifname "br-lan" ip saddr 172.16.1.2 ip daddr 192.168.1.0/24 tcp sport 53 ctstate related,established counter accept