router.nft

table netdev filter {
  chain att {
    # Traffic from the residential gateway.
    type filter hook ingress device att priority 0
    policy drop

    # Forward EAPOL frames to the fiber terminal.
    ether type 0x888e counter fwd to ont

    # Drop everything else, but count vlan and non-vlan traffic separately.
    ether type == vlan counter drop
    ether type != vlan counter drop
  }

  chain ont {
    # Taffic from the fiber terminal.
    type filter hook ingress device ont priority 0
    policy drop

    # Forward EAPOL frames to the residential gateway.
    vlan type 0x888e counter fwd to att

    # Allow vlan-tagged traffic, reject everything else.
    ether type == vlan counter accept
    ether type != vlan counter drop
  }
}