Update

services/firewall/rules.nft

@@ -4,6 +4,7 @@ define wan = eth0
 define vpn = wg0
 define vpn_net = 10.0.0.0/24
 define lan_net = 192.168.2.0/24
+define self = 192.168.2.22
 
 define icmpv4_basic = {
   echo-reply, # type 0 / ping
@@ -35,6 +36,12 @@ define icmpv6_slaac = {
 define lan_clients = { 10.0.0.3 }
 
 table inet firewall {
+  # chain prerouting {
+  #   type nat hook prerouting priority 0;
+  #   # Example of port forwarding HTTP (80) from specific LAN clients to a local server
+  #   ip saddr 10.0.0.4 ip daddr $self tcp dport 80 dnat to $self:9999
+  # }
+
   chain postrouting {
     type nat hook postrouting priority 100;