My case is about Clash, a VPN-like service. It listens on a DNS port and accepts and redirects traffic based on rules.

It works well for LAN traffic, but I want to make the router itself able to reach GitHub, Google, etc., which are blocked in China.

My Clash instance listens on 0.0.0.0:7874 and creates a utun interface. It resolves domains to a fake IP range, such as 198.18.0.0/15. I redirect LAN DNS traffic to 7874 (which was originally sent to port 53). If the DNS results fall within the fake IP range, the traffic goes to utun, allowing LAN devices to access GitHub and Google.

I need to achieve the same on the router itself. Here is what I do manually:

sudo nft add chain ip vyos_nat OUTPUT { type nat hook output priority -100 \; }
sudo nft add rule ip vyos_nat OUTPUT tcp dport 53 dnat to 127.0.0.1:7874
sudo nft add rule ip vyos_nat OUTPUT udp dport 53 dnat to 127.0.0.1:7874

I haven't found any other way to achieve this.

I plan to add an entry like this:

nat/
    output/
        rule xxx/
            destionation ...
            outbound-interface ...
            protocol ...
            translation/
                address ...
                port ...

Maybe I can copy config tree from nat/destination.

Additionally, I plan to add chain OUTPUT in nftables-nat.j2.