nftables で、特定のサブネット以外のトラフィックをマスカレードする

gistfile1.txt

#!/usr/sbin/nft -f

flush ruleset

table inet filter {
        chain input {
                type filter hook input priority 0;
        }
        chain forward {
                type filter hook forward priority 0;
        }
        chain output {
                type filter hook output priority 0;
        }
}

table ip nat {
  chain prerouting {
    type nat hook prerouting priority 0;
  }
  chain postrouting {
    type nat hook postrouting priority 100;
    ip daddr != {10.20.0.0/16} oifname "eth0" masquerade
  }
}