fix(net): keep waydroid0 out of bond0, allow it through nftables

systemd-networkd's Type=ether matcher was enslaving waydroid0 into
bond0 the moment 'waydroid session start' ran, taking down the host's
default route. Mirror the libvirt/docker negation pattern.

Also mirror the existing virbr0 forward accepts for waydroid0 so the
Android container can actually reach the internet through MASQUERADE.

1 files changed, 6 insertions, 0 deletions

diff --git a/etc/nftables.conf b/etc/nftables.conf
index f22150e..dd5e09c 100644
--- a/etc/nftables.conf
+++ b/etc/nftables.conf
@@ -38,5 +38,11 @@ table inet filter {
     # load before libvirtd has created virbr0 at boot.
     iifname "virbr0" accept comment "libvirt: guest egress"
     oifname "virbr0" ct state established,related accept comment "libvirt: guest return"
+
+    # Waydroid's NAT bridge: same pattern as libvirt. Waydroid configures its
+    # own MASQUERADE in nat/POSTROUTING but does NOT add forward accepts, so
+    # without these the Android container has no outbound network.
+    iifname "waydroid0" accept comment "waydroid: guest egress"
+    oifname "waydroid0" ct state established,related accept comment "waydroid: guest return"
   }
 }