---

sudo tee /etc/nftables.conf << 'EOF'
#!/usr/sbin/nft -f

flush ruleset

# Таблица NAT
table ip nat {
    chain prerouting {
        type nat hook prerouting priority -100; policy accept;
        iifname "enp0s9" tcp dport 80 dnat to 192.168.12.10
    }
    chain postrouting {
        type nat hook postrouting priority 100; policy accept;
        oifname "enp0s3" masquerade
    }
}

# Таблица FILTER (отдельно!)
table inet filter {
    chain input {
        type filter hook input priority filter; policy drop;
        ct state established,related accept
        iifname "lo" accept
        ip saddr 192.168.12.0/24 tcp dport 22 accept
        udp dport 53 accept
        tcp dport 53 accept
        ip saddr 192.168.12.0/24 tcp dport 3144 accept
        ip protocol icmp accept
        log prefix "INPUT_DROP: " drop
    }
    chain forward {
        type filter hook forward priority filter; policy accept;
        ip saddr 192.168.12.0/24 oifname "enp0s3" accept
        ip daddr 192.168.12.0/24 iifname "enp0s3" ct state established,related accept
    }
    chain output {
        type filter hook output priority filter; policy accept;
    }
}
EOF