nft add table inet nat nft add chain inet nat prerouting { type nat hook prerouting priority 0 \; } nft add chain inet nat postrouting { type nat hook postrouting priority 100 \; } nft add set inet nat exclude_ips { type ipv4_addr; flags interval; } nft add element inet nat exclude_ips { 192.168.100.1 } nft add rule inet nat prerouting iif "eth0" tcp daddr != @exclude_ips dnat 192.168.100.1:1080 nft add rule inet nat postrouting oif "eth0" masquerade