# Tworzymy nowy plik:
nano /etc/sysctl.d/99-proxmox-nat.conf

net.ipv4.ip_forward=1
net.ipv6.conf.all.forwarding=1

sysctl --system

sysctl -p /etc/sysctl.d/99-proxmox-nat.conf

cat /proc/sys/net/ipv4/ip_forward

#!/usr/sbin/nft -f

flush ruleset

define WAN = "vmbr0"
define LAN_NAT = "vmbr1"
define LAN_NET = 10.0.0.0/24

table inet filter {
        chain input {
                type filter hook input priority filter;
                iif "lo" accept
                ct state established,related accept
                ct state invalid drop

                # SSH do Proxmox - opcjonalnie ogranicz do swojej sieci LAN
                iifname $WAN tcp dport 22 accept

                # ICMP/ping
                ip protocol icmp accept
                ip6 nexthdr icmpv6 accept

                # GUI Proxmox
                tcp dport 8006 accept

        }
        chain forward {
                type filter hook forward priority filter;

                ct state established,related accept
                ct state invalid drop

                # VM z sieci NAT mogą wychodzić do internetu/LAN
                iifname $LAN_NAT oifname $WAN ip saddr $LAN_NET accept

                # Ruch z zewnątrz tylko wtedy, gdy jest DNAT/port forwarding
                iifname $WAN oifname $LAN_NAT ct status dnat accept

        }
        chain output {
                type filter hook output priority filter;
        }
}

table ip nat {
        chain prerouting {
                type nat hook prerouting priority -100; policy accept;

                # Przykład: Proxmox:8080 -> VM 10.0.0.10:80
                iifname $WAN tcp dport 8080 dnat to 10.0.0.10:80

                # Przykład: Proxmox:2222 -> VM 10.0.0.10:22
                iifname $WAN tcp dport 2222 dnat to 10.0.0.10:22
        }
        chain postrouting {
                type nat hook postrouting priority 100; policy accept;

                # NAT dla VM wychodzących przez vmbr0
                oifname $WAN ip saddr $LAN_NET masquerade
        }
}

# weryfikacja konfiguracji:
nft -c -f /etc/nftables.conf

# załadowanie pliku:
nft -f /etc/nftables.conf

# restart zapory:
systemctl restart nftables

auto lo
iface lo inet loopback

iface nic0 inet manual

auto vmbr0
iface vmbr0 inet static
        address 192.168.0.30/24
        gateway 192.168.0.1
        bridge-ports nic0
        bridge-stp off
        bridge-fd 0

auto vmbr1
iface vmbr1 inet static
        address 10.0.0.1/24
        bridge-ports none
        bridge-stp off
        bridge-fd 0

source /etc/network/interfaces.d/*

IP:      10.0.0.10/24
Gateway: 10.0.0.1
DNS:     8.8.8.8 albo adres routera