feat(nat): Enable nat (with ip_forward)

machines/vault01/networking.nix

@@ -190,5 +190,21 @@ in
     };
   };
 
-  networking.firewall.allowedUDPPorts = [ 67 ];
+  networking = {
+    nftables = {
+      enable = true;
+      tables.nat = {
+        family = "ip";
+        content = ''
+          chain postrouting {
+            type nat hook postrouting priority 100;
+            snat ip to 129.199.195.130-129.199.195.158
+          }
+        '';
+      };
+    };
+    firewall.allowedUDPPorts = [ 67 ];
+  };
+
+  boot.kernel.sysctl."net.ipv4.ip_forward" = true;
 }