#!/usr/sbin/nft -f

table ip xray {
    set dst_list {
        type ipv4_addr
        auto-merge
        flags interval
    }

    set dst_exclude {
        type ipv4_addr
        flags interval
        auto-merge
    }

    set src_list {
        type ipv4_addr
        flags interval
        auto-merge
        elements = { 10.1.0.0/24, 10.2.0.0/24 }
    }

    set src_exclude {
        type ipv4_addr
        flags interval
        auto-merge
        elements = { 10.1.0.6/32 }
    }

    chain prerouting {
        type filter hook prerouting priority mangle; policy accept;

        ip saddr @src_list ip saddr != @src_exclude ip protocol tcp ip daddr @dst_list ip daddr != @dst_exclude tproxy to 127.0.0.1:61219 meta mark set 10
        ip saddr @src_list ip saddr != @src_exclude ip protocol udp ip daddr @dst_list ip daddr != @dst_exclude tproxy to 127.0.0.1:61219 meta mark set 10
    }
}