ansible/roles/nftables/files/30-proxy.nft

chain proxy_prerouting {
    type filter hook prerouting priority filter - 50; policy accept;

    fib daddr type local accept

    meta mark 0x00000001 iif "lo" meta l4proto { tcp, udp } tproxy ip to :61219 counter accept

    include "/etc/nftables.d/90-proxy-prerouting.nft"
}

chain proxy_output {
    type route hook output priority mangle; policy accept;

    meta mark != 0 return
    include "/etc/nftables.d/90-proxy-output.nft"
}