<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - Rules in second chain same hook ignored if first chain has policy drop"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1305">1305</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Rules in second chain same hook ignored if first chain has policy drop
</td>
</tr>
<tr>
<th>Product</th>
<td>nftables
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>x86_64
</td>
</tr>
<tr>
<th>OS</th>
<td>Debian GNU/Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P5
</td>
</tr>
<tr>
<th>Component</th>
<td>nft
</td>
</tr>
<tr>
<th>Assignee</th>
<td>pablo@netfilter.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>keithwilliamsnp@gmail.com
</td>
</tr></table>
<p>
<div>
<pre>Debian Stretch, nft version 0.9.0-1 kernel 4.9.0-8-amd64
Am finding behaviour in added chains a bit different to that expected from
reading all the documentation.
I have chain
input {type filter hook input priority 0; policy drop;}
This carried most of the firewall rules. I then added another
chain
testpr {type filter hook input priority -1;}
I cut and pasted the rule to accept ftp from the input chain (where it had been
working) into the testpr chain.
ftp was blocked. The packets should have traversed testpr first, been accepted
before, if necessary entering input chain. This was obviously not happening.
I tried swapping the priorities which, as expected, put the testpr chain after
the input chain and so caused the ftp packets to be dropped.
The only way I could get it to work was to change the input policy, but then,
of course, that gave a policy of accept so the testpr chain was irrelevant. As
any packet not specifically dropped would be accepted, defeating the purpose of
a firewall.
I had the same result after changing the testpr to a non-base chain.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>