create special network for crusader which cannot ping lan

incus.nix

@@ -4,11 +4,29 @@
   virtualisation.incus.enable = true;
   networking = {
     nftables.enable = true;
-    firewall.interfaces = {
-      incusbr0 = {
-        allowedTCPPorts = [ 53 67 ];
-        allowedUDPPorts = [ 53 67 ];
+    firewall = {
+      enable = true;
+      trustedInterfaces = [ "incusbr1" ];
+      filterForward = true;
+
+      extraForwardRules = ''
+        # if crusader tries to go to varian or truenas, BLOCK
+        iifname "incusbr1" oifname "incusbr0" drop
+        iifname "incusbr1" oifname "enp4s0" ip daddr 192.168.0.0/16 drop
+      '';
+
+      interfaces = {
+        incusbr0 = {
+          allowedTCPPorts = [ 53 67 ];
+          allowedUDPPorts = [ 53 67 ];
+        };
+        incusbr1 = {
+          allowedTCPPorts = [ 53 ];
+          allowedUDPPorts = [ 53 67 68 ];
+        };
       };
+
+      
     };
   };