<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - tables/chains priority doesn't work"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1399">1399</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>tables/chains priority doesn't work
</td>
</tr>
<tr>
<th>Product</th>
<td>nftables
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>x86_64
</td>
</tr>
<tr>
<th>OS</th>
<td>Debian GNU/Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>enhancement
</td>
</tr>
<tr>
<th>Priority</th>
<td>P5
</td>
</tr>
<tr>
<th>Component</th>
<td>kernel
</td>
</tr>
<tr>
<th>Assignee</th>
<td>pablo@netfilter.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>david@hajes.org
</td>
</tr></table>
<p>
<div>
<pre>running latest Debian 10 in VPS/KVM - nftables v0.9.2 (Scram)
nftables are initialized by scripts. I have following tables/chains
table ip nat {
set bad_ip {
type ipv4_addr
}
chain prerouting {
type nat hook prerouting priority dstnat; policy accept;
meta nftrace set 1 ip saddr @bad_ip tcp dport { 80, 443 } redirect to
:8080
}
}
table filter {
chain prerouting {type filter hook prerouting priority -150;}
chain input {type filter hook input priority 0; policy drop;}
chain output {type filter hook output priority 0; policy drop;}
}
chain input {
type filter hook input priority filter; policy drop;
iifname "lo" accept
ct state established,related accept
ct state new ip daddr $ip_external tcp sport 1024-65535 tcp dport { 22,
80, 443, 8080 } accept
}
there is more rules but this is for simplicity. I am trying to achieve a
redirect of blocked IPs/CIDR to port 8080.
If I understand correctly "nat prerouting" is before routing decision and thus
before "filter input".
I used "nft -nn monitor trace" and "nat prerouting" is ignored and "filter
input" is executed.
I wonder what is going on, documentation is sparse...nft doesn't complain about
added rules but they are not executed.
any suggestion, please?
Regards
David</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>