Edge Router: Port Forwarding and Masquerade with nftables

This host is the edge router between the office LAN and the outside world, and right now nothing crosses it: forwarding is off and there are no NAT rules. Both networks are real network namespaces on this box, so you can test from either side. /root/case/brief.txt has this session's addresses and ports.

On the live system:

1. Port forwarding. A connection from the outside client to this host's WAN address on the public port reaches the app server's real port on the LAN (DNAT).

2. Outbound NAT. A connection the app server opens to the outside client arrives from this host's WAN address. The outside world has no route back to the LAN, so without masquerade (or SNAT) out of wan0 the replies never come back.

3. Persistence. The NAT rules are in /etc/nftables.conf, and IP forwarding is enabled in /etc/sysctl.conf or a file under /etc/sysctl.d/.

Grading sends real connections through this host from both namespaces, then loads /etc/nftables.conf into a scratch namespace to check what boot would load.