{ ... }: {
  networking = {
    nat.enable = false;
    firewall.enable = false;
    nftables = {
      enable = true;
      ruleset = ''
        table inet filter {
          # enable flow offloading for better throughput
          # flowtable f {
          #   hook ingress priority 0;
          #   devices = { lan, server, wg_cloonar, smart, multimedia, guest };
          # }

          chain output {
            type filter hook output priority 100; policy accept;
          }

          chain input {
            type filter hook input priority filter; policy drop;

            # accept any localhost traffic
            iif lo accept

            # Allow trusted networks to access the router
            iifname {
              "wan", # disable when final
              "lan",
              "wg_cloonar"
            } counter accept

            # Allow networks to access the dns
            iifname {
              "lan",
              "server",
              "wg_cloonar",
              "smart",
              "multimedia"
            } udp dport { 53, 67, 68 } tcp dport { 80, 443, 853 } counter accept

            # Accept mDNS for avahi reflection
            # iifname "multimedia" ip saddr <chromecast IP> tcp dport { llmnr } counter accept
            # iifname "multimedia" ip saddr <chromecast IP> udp dport { mdns, llmnr } counter accept

            # Allow returning traffic from wg_cloonar and drop everthing else
            iifname "wg_cloonar" ct state { established, related } counter accept
            iifname "wg_cloonar" drop
          }

          chain forward {
            type filter hook forward priority filter; policy drop;

            # enable flow offloading for better throughput
            # ip protocol { tcp, udp } flow offload @f

            # multimedia airplay
            iifname "multimedia" oifname { "lan" } counter accept

            # lan and vpn to any
            iifname { "lan", "wg_cloonar" } oifname { "server", "multimedia", "smart", "wrwks", "wg_epicenter", "wg_ghetto_at" } counter accept

            # Allow trusted network WAN access
            iifname {
              "lan",
              "server",
              "multimedia",
              "smart",
              "wg_cloonar",
            } oifname {
              "wan",
            } counter accept comment "Allow trusted LAN to WAN"

            # Allow established WAN to return
            iifname {
              "wan",
            } oifname {
              "lan",
              "server",
              "multimedia",
              "smart",
              "wg_cloonar",
            } ct state established,related counter accept comment "Allow established back to LANs"
          }
        }

        table ip nat {
          chain prerouting {
            type nat hook prerouting priority filter; policy accept;
          }

          # Setup NAT masquerading on the ppp0 interface
          chain postrouting {
            type nat hook postrouting priority filter; policy accept;
            oifname { "wan", "wrwks", "wg_epicenter", "wg_ghetto_at" } masquerade
          }
        }
      '';
    };
  };
}