Qubes Networking question

I have a question which bothered me for some time, and I really tried to find the answer by reading the documentation and cloning some git repos (at least for qubes-core and qubes-admin).

The question is: where are the (nft) interface groups defined? for example, group 9 seems to be “VPN interfaces”, and group 2 is used in rules like:

chain prerouting {
type filter hook prerouting priority raw; policy accept;
iifgroup 2 goto antispoof
ip saddr @downstream counter packets 0 bytes 0 drop

I looked initially in /etc/iproute2/groups in sys-firewall, but there’s only the default group (0) there.
Note that the @downstream set is clearly defined on sys-firewall.

I think it was arbitrary choice by @1choice here:

And you can use any other unused group number instead of 9.


Thanks, @apparatus !