alternate approach to actually protect LAN hosts (from "WAN LAN" hosts) on a gateway (NAT != secure)

fib_daddr_nat

# not sure if raw or mangle makes more sense, but it seem to work fine as long as it's no "later" than dstnat

type filter hook prerouting priority dstnat; policy accept;

# the ". iif" part is probably irrelevant for this case,
# it should probably be removed if the "usual" behavior of the input traffics needs to be retained

# if it's for a "real" WAN, it might be desirable to also drop multicast (and even broadcast?) traffics

iifname "$WAN" fib daddr . iif type != { local, broadcast, multicast } drop

# apparently for some reason you need mangle instead if you do not want ". iif"