Openwrt example using firewall sets and dnat

You can created a set in the firewall config and use it to exclude rfc1918 addresses
Use the nft command to check for rule hits.
Discuss on the forums: forum.openwrt.org/t/how-can-i-find-the-possible-options-of-uci-firewall-rules-target/153475/7