本文主要介绍如何使用nftables和brctl实现上行网口和局域网的配置，配置文件/etc/nftables.conf如下：

#!/usr/sbin/nft -f

flush ruleset
table ip nat {
    chain postrouting {
        type nat hook postrouting priority srcnat; policy accept;
        oif "eth0" masquerade
    }
}

table ip filter {
    chain input {
        type filter hook input priority filter; policy accept;
    }

    chain forward {
        type filter hook forward priority filter; policy accept;
        iif "br-lan" oif "eth0" accept
        iif "eth0" oif "br-lan" ct state established,related accept
    }

    chain output {
        type filter hook output priority filter; policy accept;
    }
}

上面是我的nftables配置，主要功能包括：