Can't forward a number of IP addresses in nftables from wan port (eth0) to VLAN port (wg0) on ip 10.0.0.2?

Question

VPN

I don't understand how it works, I've already tried everything.
Here is my hellish config:

#!/bin/bash
nft flush ruleset
#nft add table ip filter

#-----------------Type nat POSTROUTING Chain (for ipv4)---------------
#nft add table ip nat
#nft add chain nat POSTROUTING { type nat hook postrouting priority 0 \; }
#nft add rule ip nat POSTROUTING oifname "eth0" counter iifname "wg0"
#nft add rule ip nat POSTROUTING oifname "eth0" ip saddr 10.0.0.0/24 counter masquerade
#-----------------Type nat PREROUTING Chain (for ipv4)----------------



nft add table ip nat
nft add chain nat PREROUTING { type nat hook prerouting priority 2 \; }
nft add rule ip nat PREROUTING iifname "eth0" tcp dport { 224 } log prefix "wg0" dnat 127.0.0.1
#nft add rule ip nat PREROUTING iifname "wg0" tcp dport {224} counter dnat to 10.0.0.2
#nft add rule ip nat PREROUTING oifname "eth0" tcp dport {224} dnat to 10.0.0.2
#nft add rule ip nat PREROUTING iifname "eth0" tcp dport {224} counter dnat to iifname "wg0" ip dnat 10.0.0.2 

#nft add chain nat PREROUTING { type nat hook prerouting priority 0 \; }

#nft add rule ip nat PREROUTING iifname "wg0" tcp dport {80, 443, 224, 3000} counter dnat to 10.0.0.2
#nft add rule nat PREROUTING iif "eth0" tcp dport {224} dnat to 10.0.0.2
#nft add rule nat PREROUTING iif "eth0" tcp dport {224} dnat "wg0" tcp dport

#nft add rule ip nat PREROUTING iif eth0 tcp dport 224 dnat to 10.0.0.2
#nft add rule daddr 10.0.0.2 masquerade

#nft add rule ip daddr 10.0.0.2 masquerade
#nft add rule ip nat daddr 10.0.0.2 masquerade
#nft add rule ip nat PREROUTING daddr 10.0.0.2 masquerade
#nft add rule nat PREROUTING iif "wg0" tcp dport { 80, 443, 224, 3000} dnat to 10.0.0.2
#nft add rule nat PREROUTING iif "wg0" tcp dport { 80, 443, 224, 3000} dnat to 194.58.120.103/24
#nft add rule nat POSTROUTING ip saddr 10.0.0.2 oif "eth0" snat to counter masquerade

#nft add rule ip nat POSTROUTING ip saddr 10.0.0.2 

nft add chain nat PREROUTING_2 { type nat hook prerouting priority 10 \; }
nft add rule nat PREROUTING_2 meta nftrace set 1



#nft add chain nat postrouting { type nat hook postrouting priority 0 \; }
#nft add rule ip nat postrouting oifname eth0 ip daddr 10.0.0.2 masquerade

Answer 1

Basically, one rule per preroute is enough to allow a forward (if it is disabled by default).

sudo nft add rule nat PREROUTING iifname "eth0" tcp dport {224} dnat 10.0.0.2

(wg0) on ip 10.0.0.2?

Who is his GW? If not this server, then you also need SNAT (masquerade),

sudo nft add rule nat postrouting oifname wg0 masquerade