chain vpn_prerouting_dnat {
    type nat hook prerouting priority dstnat - 5; policy accept;

    iifname wg0 ip daddr 10.250.251.0/24 counter dnat ip prefix to 10.1.0.0/24
    iifname wg0 ip daddr 10.250.252.0/24 counter dnat ip prefix to 10.2.0.0/24
    iifname wg0 ip daddr 10.250.253.0/24 counter dnat ip prefix to 10.10.0.0/24
    iifname wg0 ip daddr 10.250.254.0/24 counter dnat ip prefix to 10.11.0.0/24
    iifname wg0 ip daddr 10.250.255.0/24 counter dnat ip prefix to 10.12.0.0/24
    iifname wg0 ip daddr 10.250.249.0/24 counter dnat ip prefix to 10.13.0.0/24
}

chain vpn_postrouting_snat {
    type nat hook postrouting priority srcnat; policy accept;

    oifname wg0 ip saddr 10.1.0.0/24 counter snat ip prefix to 10.250.251.0/24
    oifname wg0 ip saddr 10.2.0.0/24 counter snat ip prefix to 10.250.252.0/24
    oifname wg0 ip saddr 10.10.0.0/24 counter snat ip prefix to 10.250.253.0/24
    oifname wg0 ip saddr 10.11.0.0/24 counter snat ip prefix to 10.250.254.0/24
    oifname wg0 ip saddr 10.12.0.0/24 counter snat ip prefix to 10.250.255.0/24
    oifname wg0 ip saddr 10.13.0.0/24 counter snat ip prefix to 10.250.249.0/24
}

chain vpn_prerouting_pbr {
    type filter hook prerouting priority mangle - 10; policy accept;

    iifname wg0 ct state new counter ct mark set 0x000000c7
    ip daddr 10.0.0.0/8 return
    iifname != "wg0" ct mark 0x000000c7 counter mark set 0x000000c7
}

chain vpn_output_pbr {
    type route hook output priority mangle - 10; policy accept;

    ct mark 0x000000c7 counter meta mark set 0x000000c7
}