Wireguard/NAT issue with FirewallBackend=nftables

[Patrick Laimböck]

Hi,

I have setup a wireguard connection between my laptop (Fedora 39) and an 
Almalinux 9 x86_64 server which also runs a knot DNS resolver on port 53 
(IPv4 & IPv6) to be used by the laptop when the wireguard connection is 
active. This all works fine but it requires:

/etc/firewalld/firewalld.conf
FirewallBackend=iptables

and these firewall-cmd rules in the server's wireguard wg0 config:
(this is one long line but separated for clarity)

PostUp =

firewall-cmd --zone=public --add-port=443/udp;

firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -s 
192.168.2.0/24 -o eth0 -j MASQUERADE;

firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -i %i -j ACCEPT;

firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i %i -o eth0 -j 
ACCEPT;

firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i eth0 -o %i -j 
ACCEPT;

firewall-cmd --direct --add-rule ipv6 nat POSTROUTING 0 -s 
fdcc:xxxx:xxxx::/64 -o eth0 -j MASQUERADE;

firewall-cmd --direct --add-rule ipv6 filter INPUT 0 -i %i -j ACCEPT;

firewall-cmd --direct --add-rule ipv6 filter FORWARD 0 -i %i -o eth0 -j 
ACCEPT;

firewall-cmd --direct --add-rule ipv6 filter FORWARD 0 -i eth0 -o %i -j 
ACCEPT;

When, on the server, I switch to
FirewallBackend=nftables

and restart firewalld and do wg-quick up wg0 then I can no longer access 
the DNS resolver on the wireguard server's public IPv4 & IPv6 address 
from the client. If I change the DNS in the client's wireguard config to 
9.9.9.9 & 2620:fe::fe then resolving on the client works fine. So 
somehow the iptables and nftables backend handle this differently (or 
the firewall-cmd rules are wrong?).

Anyone know how to make this work with the nftables backend?
Please let me know if you need any other information. Thanks!

Best,
Patrick