Porting a DD-WRT iptables isolation setup to OpenWrt’s fw4/nftables - and discovering that re-implementing on a foreign stack is the only honest test of which parts were the network and which were just the router.