Wireguard für einen Vollnoob

[Interface]
Address = 100.64.64.1/24
PrivateKey = XXX
ListenPort = 65500
MTU = wenn nur hier
PostUp = nft add table ip filter
#PostUp = nft add table ip6 filter
PostUp = nft add chain ip filter FORWARD '{ type filter hook forward priority 0; policy accept; }'  
#PostUp = nft add chain ip6 filter FORWARD '{ type filter hook forward priority 0; policy accept; }' 
PostUp = nft add rule ip filter FORWARD iifname "%i" counter accept  
PostUp = nft add rule ip filter FORWARD oifname "%i" counter accept  
#PostUp = nft add rule ip6 filter FORWARD iifname "%i" counter accept 
#PostUp = nft add rule ip6 filter FORWARD oifname "%i" counter accept 
PostDown = nft flush ruleset
[Peer]
PublicKey = QyOyJlSEdPEsVQ6uNjI4WxhLZPmlvP4GfKOwQFLr0U4=
AllowedIPs = 100.64.64.100/32

Client:
[Interface]
PrivateKey = XXX
Address = 100.64.64.100/24
DNS = 192.168.200.1 

[Peer]
PublicKey = Tu++c41fd/GMrLps9p/1Et6iQ9FS+hPtZ4VKMn9smAM=
AllowedIPs = 0.0.0.0/0
Endpoint =MEINROUTER.myfritz.net:65500

[Interface]
Address = 100.64.64.1/24, fd08:64::1/64
PrivateKey = XXX
ListenPort = 65500
MTU = wenn nur hier
PostUp = nft add table ip filter
PostUp = nft add table ip6 filter
PostUp = nft add chain ip filter FORWARD '{ type filter hook forward priority 0; policy accept; }'  
PostUp = nft add chain ip6 filter FORWARD '{ type filter hook forward priority 0; policy accept; }'  
PostUp = nft add rule ip filter FORWARD iifname "%i" counter accept  
PostUp = nft add rule ip filter FORWARD oifname "%i" counter accept  
PostUp = nft add rule ip6 filter FORWARD iifname "%i" counter accept  
PostUp = nft add rule ip6 filter FORWARD oifname "%i" counter accept  
PostUp = nft add rule ip6 nat POSTROUTING ip6 saddr { fd08:64::100 } oifname "eth0" counter masquerade  
PostDown = nft flush ruleset
[Peer]
PublicKey = QyOyJlSEdPEsVQ6uNjI4WxhLZPmlvP4GfKOwQFLr0U4=
AllowedIPs = 100.64.64.100/32, fd08:64::100/128

Client:
[Interface]
PrivateKey = XXX
Address = 100.64.64.100/24, fd08:64::100/64
DNS = 192.168.200.1

[Peer]
PublicKey = Tu++c41fd/GMrLps9p/1Et6iQ9FS+hPtZ4VKMn9smAM=
AllowedIPs =  0.0.0.0/0, ::/0
Endpoint =MEINROUTER.myfritz.net:65500

#!/usr/sbin/nft -f

flush ruleset

table inet filter {
	chain input {
		type filter hook input priority filter;
	}
	chain forward {
		type filter hook forward priority filter;
	}
	chain output {
		type filter hook output priority filter;
	}
} 

#!/usr/sbin/nft -f

flush ruleset

# Interface name
define pub_iface = "eth0"  
# Wireguard port
define wg_port = 51820

table inet drop-bad-ct-states {
	chain prerouting {
		type filter hook prerouting priority -150; policy accept;
		# drop packets in "invalid" connection-tracking state 
		ct state invalid drop
		# drop tcp packets for new connections that aren't syn packets 
		tcp flags & (fin|syn|rst|ack) != syn ct state new counter drop
		# drop XMAS packets.
		tcp flags & (fin|syn|rst|psh|ack|urg) == fin|syn|rst|psh|ack|urg counter drop
		# drop NULL packets.
		tcp flags & (fin|syn|rst|psh|ack|urg) == 0x0 counter drop
		# drop new connections over rate limit
		ct state new limit rate over 1/second burst 20 packets drop
		}
}

table inet filter {
	chain input {
		type filter hook input priority 0; policy drop;
		# accept any localhost traffic
		iif lo accept

		# accept any Wireguard traffic
		iifname "wg0" accept  

		# accept traffic originated from us
		ct state established,related accept

		# accepted ICMP types		
		ip protocol icmp icmp type { time-exceeded, parameter-problem, destination-unreachable } accept

		# accept common local TCP services on public interface
		iif $pub_iface tcp dport { ssh, https } ct state new accept

		# accepted UDP ports on public interface 
		iif $pub_iface udp dport { $wg_port } accept 

		# accept neighbour discovery otherwise IPv6 connectivity breaks.
		ip6 nexthdr icmpv6 icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept

		# Log and count dropped traffic
		# log prefix "[nftables]Denied: " counter drop 
		# Only count dropped traffic
		counter drop
	}
	chain forward {
		type filter hook forward priority filter; policy drop;
		# accept Wireguard traffic
		ip saddr { 100.64.64.0/24 } ip daddr { 192.168.178.0/24 } accept
	}
	chain output {
		type filter hook output priority filter;
	}
} 

nft list ruleset
table ip filter {
}
table ip6 nat {
        chain POSTROUTING {
                type nat hook postrouting priority srcnat; policy accept;
                ip6 saddr { fd08::2, fd08::3, fd08::4, fd08::5 } oifname "enp1s0" counter packets 68 bytes 7836 masquerade