title: What does wg-quick nftables rules do?
body: <p>When I add a wireguard interface via <code>wg-quick up wg0</code>, wg-quick sets up the following nftable rules. What are these doing and why are they needed?</p>
  <p>Here are some example rules for ipv4:</p>
  <pre><code>table ip wg-quick-wg0 {
      chain preraw {
          type filter hook prerouting priority raw; policy accept;
          iifname != &quot;wg0&quot; ip daddr 10.4.125.231 fib saddr type != local drop
      }
      chain premangle {
          type filter hook prerouting priority mangle; policy accept;
          meta l4proto 17 meta mark set ct mark
      }
      chain postmangle {
          type filter hook postrouting priority mangle; policy accept;
          meta l4proto 17 meta mark 0x0000ca6c ct mark set meta mark
      }
  }
  </code></pre>
  <p>I am interested in these, because my virtual machine needs those to function properly, but my host does not need them to have a working wireguard interface. Sadly the script itself is not documented on why they are setup.</p>