Verständnisfrage // Problem nftables + POSTROUTING

user@lxTest:/$ sudo nft list ruleset
table ip nat {
        chain prerouting {
                type nat hook prerouting priority 0; policy accept;
                # ...
        }

        chain postrouting {
                type nat hook postrouting priority 100; policy drop;
                oifname { "ens33", "lxbr3"} masquerade
                counter packets 0 bytes 0
                log
        }
}
table inet firewall4 {
        chain input {
                type filter hook input priority 0; policy drop;
                # ...
        }

        chain output {
                type filter hook output priority 0; policy accept;
        }

        chain forward {
                # ...
        }
}

user@lxTest:~/Downloads$ ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 00:0c:29:a5:56:56 brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.240/24 brd 192.168.0.255 scope global ens33
       valid_lft forever preferred_lft forever
    inet6 fe80::20c:29ff:fea5:5656/64 scope link
       valid_lft forever preferred_lft forever
3: lxbr3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether fe:6e:44:0c:e4:40 brd ff:ff:ff:ff:ff:ff
    inet 10.47.41.1/24 scope global lxbr3
       valid_lft forever preferred_lft forever
    inet6 fe80::3c03:d5ff:fe9a:167b/64 scope link
       valid_lft forever preferred_lft forever

#!/usr/sbin/nft -f

flush ruleset

# interfaces
define ext_if1 = ens3

# management
define ip_mgmt = 123.123.123.123 # für das Beispiel hier ersetzt

# lx
define lx_if = lxdbr0
define lx_if_ip = 10.42.0.1
define lx_vm_c1 = 10.42.0.10

##########################################

table ip firewall4 {
    ##
    # basic checks
    ##
    chain base_checks {
        # allow established/related connections
        ct state {established, related} accept

        # early drop of invalid connections
        ct state invalid drop
    }
    ##
    # lx-stuff
    ##
    chain lx_filter_input {
        # dns
        iifname $lx_if ip saddr $lx_vm_c1 ip daddr $lx_if_ip udp dport 53 accept

        # dhcp
        iifname $lx_if ip saddr 0.0.0.0 ip daddr 255.255.255.255 udp sport 68 udp dport 67 accept
    }
    chain lx_filter_forward {
        # forward only packets from vm_x
        ip saddr $lx_vm_c1 iifname $lx_if accept
        ip daddr $lx_vm_c1 ct status dnat accept
    }
    chain lx_nat_prerouting {
        # tcp dport 81 dnat $lx_vm_c1:80

        # ssh c1 --> Port 123 auf 1234
        ip saddr {$ip_mgmt} tcp dport 123 dnat $lx_vm_c1:1234
    }
    ##
    # Filter
    ##
    chain filter_input {
        type filter hook input priority 0; policy drop;

        jump base_checks

        # allow from loopback interface
        iifname lo accept

        jump lx_filter_input
    }
    chain filter_output {
        type filter hook output priority 0; policy accept;

        jump base_checks
    }
    chain filter_forward {
        type filter hook forward priority 0; policy drop;

        jump base_checks
        jump lx_filter_forward
    }
    ##
    # nat
    ##
    chain prerouting {
        type nat hook prerouting priority -101; policy accept;

        jump lx_nat_prerouting
    }
    chain postrouting {
        type nat hook postrouting priority 0; policy drop;

        oifname {$ext_if1,$lx_if} masquerade
    }

}

#!/usr/sbin/nft -f

flush ruleset

# interfaces
define ext_if1 = eth0

# management
define ssh_port = 1234
define ip_mgmt = 123.123.123.123 # für das Beispiel hier ersetzt

##########################################

table ip firewall4 {
    ##
    # basic checks
    ##
    chain base_checks {
        # allow established/related connections
        ct state {established, related} accept

        # early drop of invalid connections
        ct state invalid drop
    }

    ##
    # management
    ##
    chain management_input {
        # ssh
        
        # funktioniert nicht, da saddr die IP der Bridge ist
        #ip saddr $ip_mgmt tcp dport $ssh_port log prefix "[C1] SSH: " accept
        
        # funktioniert
        tcp dport $ssh_port accept
    }

    ##
    # Filter
    ##
    chain filter_input {
        type filter hook input priority 0; policy drop;

        jump base_checks

        # allow from loopback interface
        iifname lo accept

        jump management_input

    }
    chain filter_output {
        type filter hook output priority 0; policy accept;

        jump base_checks
    }
    chain filter_forward {
        type filter hook forward priority 0; policy drop;

        jump base_checks
    }
}