0

So I have two input chains, input and dyn which is dynamically generated.

However the rules of dyn just don't work because of input. I've tried setting the priority of input to 1, and the dyn to 0 even -200. Still nothing.

When I flush the input rules, then dyn works.

What am I doing wrong here?

sudo nft list ruleset
table inet filter {
chain input {
    type filter hook input priority filter + 1; policy accept;
    iif "lo" accept
    ct state established,related accept
    tcp dport 299 ip saddr 3x.xx.xx.xx accept
    icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, echo-request, echo-reply, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, 148, 149 } accept
    ip6 saddr fe80::/10 icmpv6 type { mld-listener-query, mld-listener-report, mld-listener-done, mld2-listener-report, 151, 152, 153 } accept
    counter packets 10 bytes 5255 drop
}

chain dyn {
    type filter hook input priority filter; policy accept;
    iif "lo" accept
    ct state established,related accept
    ip saddr 2x.xx.xx.xx udp dport 8999 log prefix "dyn" accept
    ip6 saddr xxx:xxxx:xxxx:xxxx::9999 udp dport 8999 log prefix "dyn" accept
    ip saddr 2x.xx.xx.xx tcp dport 7999 log prefix "dyn" accept
    ip6 saddr xxx:xxxx:xxxx:xxxx::9999 tcp dport 7999 log prefix "dyn" accept
    ip saddr 2x.xx.xx.xx icmp type echo-request log prefix "dyn" accept
    ip6 saddr xxx:xxxx:xxxx:xxxx::9999 icmp type echo-request log prefix "dyn"
    ip saddr 2x.xx.xx.xx tcp dport 6999 log prefix "dyn" accept
    ip6 saddr xxx:xxxx:xxxx:xxxx::aaaa tcp dport 6999 log prefix "dyn" accept
}
}
Nikk
  • 7,384
  • 8
  • 44
  • 90

0 Answers0