NFTables and Openvpn killswitch

[Paul Fontenot <wpfontenot@xxxxxxxxxxx>]

Hello,

I am beating my head on the way trying to implement a vpn killswitch 
with nftables. My configuration is below and I want to allow access to 
my networks (192.168.0.0/24 which is working) as well as allowing vmware 
to do it's thing over vmnet8 (which is also working). I am almost 
certain this a "can't see the forest for the trees" issue at this point.

When the VPN connects and these rules are applied everything except the 
VPN works as expected and if the rulese are not applied the VPN works as 
expected.

#!/usr/sbin/nft -f

flush ruleset

table inet filter {
        chain input {
                type filter hook input priority 0; policy drop;
                counter
                ip protocol icmp accept
                ct state {related, established } accept
                ct state invalid drop
                iif lo accept
                iifname "enp3s0f1" jump input_enp3s0f1
                iifname "wlp2s0" jump input_wlp2s0
                iifname "vmnet8" jump input_vmnet8
                iifname "tun0" jump input_tun0
        }
        chain forward {
                type filter hook forward priority 0; policy drop;
                counter
        }
        chain output {
                type filter hook output priority 0; policy drop;
                counter
                oif { lo, tun0 } accept
                oif { enp3s0f1, wlp2s0 } ip daddr 192.168.0.0/24 accept
                oif { vmnet8 } accept
        }
        chain input_enp3s0f1 {
                counter
        }
        chain input_wlp2s0 {
                counter
        }
        chain input_vmnet8 {
                counter
                iifname "vmnet8" accept
        }
        chain input_tun0 {
                counter
        }
}