I discovered this gem:

root@OpenWrt:~# cat /etc/ppp/filter
#
# Expression: outbound and not icmp[0] != 8 and not tcp[13] & 4 != 0
#
19
48 0 0 0
21 0 16 1
40 0 0 2
21 0 13 33
48 0 0 13
21 0 5 1
40 0 0 10
69 9 0 8191
177 0 0 4
80 0 0 4
21 6 7 8
21 0 5 6
40 0 0 10
69 3 0 8191
177 0 0 4
80 0 0 17
69 1 0 4
6 0 0 4
6 0 0 0

          environment = {
            # pppd likes to write directly into /var/run. This is rude
            # on a modern system, so we use libredirect to transparently
            # move those files into /run/pppd.
            LD_PRELOAD = "${pkgs.libredirect}/lib/libredirect.so";
            NIX_REDIRECTS = "/var/run=/run/pppd";
          };