#!/bin/sh
# Hook firewall ipset into PBR destination routing

IPSET_NAME="my_dest_ips"
TARGET_INT="wan2"

if nft list chain inet fw4 pbr_prerouting >/dev/null 2>&1; then
    # Dynamically extract the underlying PBR routing table ID for the target interface
    TABLE_ID=$(ip route show table all | grep -m1 "dev $TARGET_INT" | awk '{print $NF}')
    
    if [ -n "$TABLE_ID" ]; then
        # Force traffic matching the firewall's destination IP set into the targeted routing table
        nft insert rule inet fw4 pbr_prerouting ip daddr @$IPSET_NAME ip route oif $TARGET_INT accept
    fi
fi