table ip nat {
  chain post {
    type nat hook postrouting priority filter; policy accept;
    ip saddr 10.0.0.0/24 oif "wlx00c0ca9664eb" snat to 10.0.0.1
  }

  chain pre {
    type nat hook prerouting priority filter; policy accept;
  }

  chain prerouting {
    type nat hook prerouting priority filter; policy accept;
  }

  chain postrouting {
    type nat hook postrouting priority srcnat; policy accept;
    oifname "wlx00c0ca9664eb" masquerade
  }
}

wlx00c0ca9664eb

wlp8s0

table inet filter {
  chain input {
    type filter hook input priority 0; policy drop;

    # allow established/related connections
    ct state {established, related} accept

    # early drop of invalid connections
    iifname lo accept

    # Allow from internal network
    iifname wlx00c0ca9664eb accept
    iifname wlp8s0 accept

    # allow icmp
    ip protocol icmp accept

    # allow ssh
    tcp dport 22 accept comment "SSH in"

  }

  chain forward {
    type filter hook forward priority 0;

    # Allow outgoing via wan0
    oifname wlx00c0ca9664eb accept

    # Allow incoming on wan0 for related & established connections
    iifname wlx00c0ca9664eb ct state related, established accept

    # Drop any other incoming traffic on wan0
  }

  chain output {
    type filter hook output priority 0;
  }
}

table ip nat {
  chain prerouting {
    type nat hook prerouting priority 0;

    # Forward traffic from wan0 to a LAN server
    iifname wlx00c0ca9664eb dnat 10.0.0.1
  }

  chain postrouting {
    type nat hook postrouting priority 0;

    # Masquerade outgoing traffic
    oifname wlx00c0ca9664eb masquerade
  }
}