I have an upstream opnsense router which manages flow between various vlans. I still need fail2ban on the server. If i turn on the networking.firewall.enable it stops the traffic flow. I had to disable it and instead specify a ruleset,

networking.nftables.ruleset=''
table inet mytable {
      
    chain input {
        type filter hook input priority 0; policy drop;
      
        # Allow loopback traffic
        iif lo accept
      
        # Allow established and related connections
        ct state established,related accept 
      
        iifname "vlan2br" accept
        iifname "vlan300br" accept
        iifname "vlan400br" accept
        iifname "vlan500br" accept
        iifname "vlan600br" accept

        # Drop all other input traffic
        counter drop
    }

      # Allow all outgoing connections.
      chain output {
        type filter hook output priority 0;
        accept
      }
      
      chain forward {
        type filter hook forward priority 0;
        accept
      }
}

'';

If i turn on the nixos-fw it inserts the following which stops the flow,

        chain rpfilter {
                type filter hook prerouting priority mangle + 10; policy drop;
                meta nfproto ipv4 udp sport . udp dport { 68 . 67, 67 . 68 } accept comment "DHCPv4 client/server"
                fib saddr . mark . iif oif exists accept
                jump rpfilter-allow
        }

What does it do and can i remove this?

Is this incorrect routing?

07:25:10.320465 enp129s0 P   IP 172.16.1.28 > 172.16.3.4: ICMP echo request, id 111, seq 1, length 64
07:25:10.320465 vlan300 P   IP 172.16.1.28 > 172.16.3.4: ICMP echo request, id 111, seq 1, length 64
07:25:10.320465 vlan300br In  IP 172.16.1.28 > 172.16.3.4: ICMP echo request, id 111, seq 1, length 64
07:25:10.320519 vlan2br Out IP 172.16.3.4 > 172.16.1.28: ICMP echo reply, id 111, seq 1, length 64
07:25:10.320523 vlan2 Out IP 172.16.3.4 > 172.16.1.28: ICMP echo reply, id 111, seq 1, length 64