=== /etc/nftables.d/lab-edge-dnat.nft (실물) ===
#!/usr/sbin/nft -f
table ip lab_edge
delete table ip lab_edge

table ip lab_edge {
	chain prerouting {
		type nat hook prerouting priority dstnat; policy accept;
		iifname "tailscale0" tcp dport {80, 443} dnat to 192.168.122.10
	}

	chain forward {
		type filter hook forward priority filter - 10; policy accept;
		ip daddr 192.168.122.10 tcp dport {80, 443} ct state new accept
	}
}
=== /etc/systemd/system/lab-edge-dnat.service (실물) ===
[Unit]
Description=Lab edge DNAT (tailnet :80/:443 -> kc-lab-edge)
After=network-online.target libvirtd.service
Wants=network-online.target

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/sbin/nft -f /etc/nftables.d/lab-edge-dnat.nft
ExecStop=/usr/sbin/nft delete table ip lab_edge

[Install]
WantedBy=multi-user.target

=== 유닛 ===
active
enabled
=== sudo 는 비밀번호를 요구한다 (4·5번을 그대로 칠 수 없다) ===
sudo: a password is required