I have a Linux host acting as a router with forwarding enabled /proc/sys/net/ipv4/ip_forward = 1. It is connected to two wifi networks (wlan0 and wlan1) and it has internet access on eth0. For reasons to not explain here for brevity, I need to keep the default forward policy as DROP and just open the forwarding as needed. I have set these nft rules:

For the first network

table ip filter_ag1 {
    chain forward_ag1 {
        type filter hook forward priority filter; policy drop;
        iifname "wlan0" oifname "eth0" counter packets 231 bytes 33108 accept
        iifname "eth0" oifname "wlan0" counter packets 187 bytes 80713 accept
    }
    chain input_ag1 {
        type filter hook input priority filter; policy accept;
    }
}

table ip nat_ag1 {
    chain prerouting_ag1 {
        type nat hook prerouting priority dstnat; policy accept;
    }

    chain postrouting_ag1 {
        type nat hook postrouting priority srcnat; policy accept;
        ip saddr 192.169.1.0/24 oifname "eth0" counter packets 40 bytes 2533 masquerade
    }
}

For the second network

table ip filter_ag2 {
    chain forward_ag2 {
        type filter hook forward priority filter; policy drop;
        iifname "wlan1" oifname "eth0" counter packets 54 bytes 3461 accept
        iifname "eth0" oifname "wlan1" counter packets 0 bytes 0 accept
    }

    chain input_ag2 {
        type filter hook input priority filter; policy accept;
    }
}
table ip nat_ag2 {
    chain prerouting_ag2 {
        type nat hook prerouting priority dstnat; policy accept;
    }

    chain postrouting_ag2 {
        type nat hook postrouting priority srcnat; policy accept;
        ip saddr 192.169.2.0/24 oifname "eth0" counter packets 0 bytes 0 masquerade
    }
}

As you can see they are the same, just modifying the wireless interface.

When I launch the first one separately (without the second), it works and from the wlan0 network users can surf the Internet flawlessly. If I do the opposite is the same, users from wlan1 network can surf. The problem is when I launch all the rules together. Both stop working and nobody can surf the Internet.

I noticed that deleting any forward_agX chain, the other starts to work immediately. So the problem seems to be located there. How can I do in order to make both to work?