I forgot something in my previous post :
VERY IMPORTANT : The table in your nft file must be named like the file (the name you gave in veyon-configurator) too, or you won't be able to deactivate blocking from master.
As example, if you declare "myfile" in veyon-configurator: On clients, you must put a file called myfile in /etc/veyon/iac/firewall/rules.d/, containing your rules, and the table in this file must be called myfile too :
table inet myfile {
Don't forget to activate InternetAccessControl/UnblockOnServiceStart=true in veyon config, this is the best (only?) way to be sure internet is available for next users, without any need to do anything (automatically deactivates blocking on clients when the user logs out, or reboots).
Finally got all this running like I wanted to...
Thanks to Todybox for his precious help (and job on Veyon, of course).
E.T.