nftables, accept policy, given TCP port, LAN machines only

Question

This is a nftables beginner question.

Given the rule:

iifname $NIC_NAME tcp dport 22 accept

in the chain_input chain below:

table inet table_inet {
    chain chain_input {
        type filter hook input priority 0
        iif lo accept
        icmp type echo-request accept
        ct state established,related accept
        iifname $NIC_NAME tcp dport 22 accept
        policy drop
    }
    chain chain_output {
        type filter hook output priority 0
        policy accept
    }
    chain chain_forward {
        type filter hook forward priority 0
        policy drop
    }
}

how can I modify this rule so that only packets with an IP in the same LAN are accepted?
With iptables I used the option -m iprange --src-range 192.168.4.1-192.168.4.254 for the LAN 192.168.4.0/24.
I hope my question is clear enough.

EDIT 1

I propose:

iifname $NIC_NAME tcp dport 22 ip saddr 192.168.4.0/24 accept

With the accept policy, I can connect to the SSH server, with the drop policy, I can't.

Answer 1

Your proposed

iifname $NIC_NAME tcp dport 22 ip saddr 192.168.4.0/24 accept

seems correct to me.