求nftables配置，我的配置TUN无法使用system模式

[Mars160]

table inet filter {
        chain input {
                type filter hook input priority filter; policy drop;
                ct state invalid drop comment "early drop of invalid connections"
                ct state { established, related } accept comment "allow tracked connections"
                iifname "lo" accept comment "allow from loopback"
                tcp dport 22000 accept comment "allow sshd"
                tcp dport { 80, 443 } accept comment "allow http"
                udp dport 443 accept comment "allow QUIC"
                tcp dport { 139, 389, 445, 901 } accept comment "allow SMB TCP"
                udp dport { 137, 138 } accept comment "allow SMB UDP"
                counter packets 2171 bytes 533610
        }

        chain forward {
                type filter hook forward priority filter; policy drop;
        }
}

---

Meta配置的TUN

tun:
    auto-detect-interface: true
    auto-route: true
    auto-redir: true
    dns-hijack:
        - any:53
    enable: true
    stack: gvisor # gvisor可用，system不行

本人对nftable和iptable之类的不熟悉，想请教一下该如何配置？还是该提issue？

是本机自用的，不做局域网共享，谢谢！