fix: NAT 检测与安装脚本优先使用 nft，解决 iptables-nft 不兼容问题

- diag_linux: checkMasquerade 改为优先 nft list ruleset，iptables 执行失败时 fall through 到 nft 而非直接返回
- diag_linux: 区分"iptables-nft 与原生 nft 表不兼容"与"权限不足"两种失败场景
- install_linux.sh: NAT 工具优先级反转为 nft 优先，iptables 回退，解决 Debian 12+ 上 iptables-nft 包装器操作原生 nft nat 表报 incompatible 的问题
- install_linux.sh: nft 分支增加 /etc/nftables.conf include 配置与 systemctl enable nftables，确保重启后规则自动加载

install_linux.sh

@@ -48,7 +48,7 @@ net.ipv4.ip_forward = 1
 EOF
 sysctl -p /etc/sysctl.d/99-lmvpn.conf >/dev/null
 
-echo ">>> 配置 iptables NAT 与转发规则..."
+echo ">>> 配置 NAT 与转发规则..."
 # 自动检测默认路由出口网卡
 WAN_IFACE=$(ip route show default 2>/dev/null | awk '{print $5; exit}')
 if [ -z "$WAN_IFACE" ]; then
@@ -56,18 +56,38 @@ if [ -z "$WAN_IFACE" ]; then
 else
     echo "出口网卡: $WAN_IFACE"
 
-    # 选择可用的防火墙前端：优先 iptables，回退 nft
+    # 选择可用的防火墙前端：优先 nft（原生，Debian 12+ 的 iptables 是 nft 包装器，操作原生 nft nat 表会不兼容）
     NAT_TOOL=""
-    if command -v iptables >/dev/null 2>&1; then
-        NAT_TOOL="iptables"
-    elif command -v nft >/dev/null 2>&1; then
+    if command -v nft >/dev/null 2>&1; then
         NAT_TOOL="nft"
+    elif command -v iptables >/dev/null 2>&1; then
+        NAT_TOOL="iptables"
     fi
 
     if [ -z "$NAT_TOOL" ]; then
-        echo "警告: 未找到 iptables 或 nft，跳过 NAT 配置"
-        echo "       客户端将无法上外网。请安装: apt install iptables iptables-persistent"
+        echo "警告: 未找到 nft 或 iptables，跳过 NAT 配置"
+        echo "       客户端将无法上外网。请安装: apt install nftables"
         echo "       安装后重新执行本脚本即可自动配置"
+    elif [ "$NAT_TOOL" = "nft" ]; then
+        echo "使用 nft 配置 NAT..."
+        # 幂等：先删除旧表（忽略错误），再创建
+        nft delete table inet lmvpn_nat 2>/dev/null || true
+        nft add table inet lmvpn_nat
+        nft 'add chain inet lmvpn_nat postrouting { type nat hook postrouting priority 100 ; }'
+        nft add rule inet lmvpn_nat postrouting oifname "$WAN_IFACE" ip saddr "$VPN_SUBNET" masquerade
+        nft 'add chain inet lmvpn_nat forward { type filter hook forward priority 0 ; policy accept ; }'
+        nft add rule inet lmvpn_nat forward ip saddr "$VPN_SUBNET" accept
+        nft add rule inet lmvpn_nat forward ip daddr "$VPN_SUBNET" accept
+
+        # 持久化 nft 规则
+        mkdir -p /etc/nftables.d
+        nft list ruleset > /etc/nftables.d/lmvpn.nft
+        # 确保主配置文件 include 该目录
+        if [ -f /etc/nftables.conf ] && ! grep -q 'include "/etc/nftables.d' /etc/nftables.conf; then
+            echo 'include "/etc/nftables.d/*.nft"' >> /etc/nftables.conf
+        fi
+        systemctl enable nftables 2>/dev/null || true
+        echo "nft 规则已写入 /etc/nftables.d/lmvpn.nft"
     elif [ "$NAT_TOOL" = "iptables" ]; then
         echo "使用 iptables 配置 NAT..."
         # 幂等：先删除旧规则（忽略错误），再添加
@@ -91,22 +111,6 @@ else
         else
             echo "警告: 未找到 iptables-save，规则仅在本次运行有效，请手动持久化"
         fi
-    elif [ "$NAT_TOOL" = "nft" ]; then
-        echo "使用 nft 配置 NAT..."
-        # 幂等：先删除旧表（忽略错误），再创建
-        nft delete table inet lmvpn_nat 2>/dev/null || true
-        nft add table inet lmvpn_nat
-        nft 'add chain inet lmvpn_nat postrouting { type nat hook postrouting priority 100 ; }'
-        nft add rule inet lmvpn_nat postrouting oifname "$WAN_IFACE" ip saddr "$VPN_SUBNET" masquerade
-        nft 'add chain inet lmvpn_nat forward { type filter hook forward priority 0 ; policy accept ; }'
-        nft add rule inet lmvpn_nat forward ip saddr "$VPN_SUBNET" accept
-        nft add rule inet lmvpn_nat forward ip daddr "$VPN_SUBNET" accept
-
-        # 持久化 nft 规则
-        mkdir -p /etc/nftables.d
-        nft list ruleset > /etc/nftables.d/lmvpn.nft
-        echo "nft 规则已写入 /etc/nftables.d/lmvpn.nft"
-        echo "注意: 需确保系统启动时加载 nftables 规则，编辑 /etc/nftables.conf 添加: include \"/etc/nftables.d/lmvpn.nft\""
     fi
 fi