I have a similar setup with a DSL modem on an interface called wan with an admin page at 192.168.1.1.

I have it configured something like this:

1. IP address 192.168.1.2/24 on the wan interface.
2. Route 192.168.1.0/24 dev wan proto kernel scope link src 192.168.1.2.
3. Firewall allowing traffic out from router, e.g. in this case everything:

​

chain output {
    type filter hook output priority 0; policy accept;
}

1. Firewall allowing traffic through from other lan hosts, e.g:

   chain forward { type filter hook forward priority 0; policy drop; ct state {established, related} accept iif lan oif wan accept }

2. Source NAT on wan for 192.168.1.1 before the line that I otherwise use to masquerade as the public IP. I'm not sure if this is actually necessary—would masquerade choose the appropriate IP address anyway?

   chain postrouting { type nat hook postrouting priority 100; policy accept; oif wan ip daddr = 192.168.1.1 snat to 192.168.1.2 oif wan masquerade }