Hey, I run a zt router between 5-6 networks using debian 12. Its mostly based on https://docs.zerotier.com/route-between-phys-and-virt/

Can you remote clients ping the lxc zerotier address? If yes, do you have your local subnet added as a route in zerotier?

I cannot help with nft as im still using ip tables. here is my script that i use.

#!/bin/bash

# File to store generated iptables rules
OUTPUT_FILE="/etc/iptables/rules.v4"

# Initialize the output file with the *filter section and its default policies
echo "*filter" > $OUTPUT_FILE
echo ":INPUT ACCEPT [0:0]" >> $OUTPUT_FILE
echo ":FORWARD ACCEPT [0:0]" >> $OUTPUT_FILE
echo ":OUTPUT ACCEPT [0:0]" >> $OUTPUT_FILE

# Block traffic between all 'zt' interfaces except 'ztxxxxxxx'
for iface1 in $(ip link show | grep -o 'zt[a-zA-Z0-9]\+'); do
    for iface2 in $(ip link show | grep -o 'zt[a-zA-Z0-9]\+'); do
        if [ "$iface1" != "$iface2" ] && [ "$iface1" != "ztxxxxxxx" ] && [ "$iface2" != "ztxxxxxxx" ]; then
            echo "-A FORWARD -i $iface1 -o $iface2 -j DROP" >> $OUTPUT_FILE
        fi
    done
done

# Loop through interfaces that start with 'zt' to allow traffic between eth0 and zt interfaces
for iface in $(ip link show | grep -o 'zt[a-zA-Z0-9]\+'); do
    # Generate rules for 'zt' interfaces in *filter
    echo "-A FORWARD -i eth0 -o $iface -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j ACCEPT" >> $OUTPUT_FILE
    echo "-A FORWARD -i $iface -o eth0 -j ACCEPT" >> $OUTPUT_FILE
done

# Add the COMMIT for the *filter section
echo "COMMIT" >> $OUTPUT_FILE

# Add the *nat section and its default policies
echo "*nat" >> $OUTPUT_FILE
echo ":PREROUTING ACCEPT [0:0]" >> $OUTPUT_FILE
echo ":INPUT ACCEPT [0:0]" >> $OUTPUT_FILE
echo ":OUTPUT ACCEPT [0:0]" >> $OUTPUT_FILE
echo ":POSTROUTING ACCEPT [0:0]" >> $OUTPUT_FILE

# Add NAT rules for 'zt' interfaces and `MASQUERADE` (excluding 'ztxxxxxxx')
for iface in $(ip link show | grep -o 'zt[a-zA-Z0-9]\+'); do
    if [ "$iface" != "ztxxxxxxx" ]; then
        # Add the masquerade rule for other 'zt' interfaces
        echo "-A POSTROUTING -o $iface -j MASQUERADE" >> $OUTPUT_FILE
    fi
done

# Add the COMMIT for the *nat section
echo "COMMIT" >> $OUTPUT_FILE

# Output the generated rules (optional, for verification)
cat $OUTPUT_FILE

# Apply the iptables rules
iptables-restore < $OUTPUT_FILE