<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - Rules in first chain same hook ignored if second chain has policy drop"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1305#c9">Comment # 9</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - Rules in first chain same hook ignored if second chain has policy drop"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1305">bug 1305</a>
from <span class="vcard"><a class="email" href="mailto:brian@pondconsulting.net" title="Brian Pond <brian@pondconsulting.net>"> <span class="fn">Brian Pond</span></a>
</span></b>
<pre>"Why do you want to have separate base chains if you do not want them to
independently drop a packet?"
Because I want my separate base chains to independently -accept- a packet.
Your workaround is practical. I'm doing the same thing in my production
environments today. By using a single base chain, plus jumps to non-base
chains, I can achieve the desired behavior. I want my nftables to Log and Drop
everything by default. Except for packets I have explicitly Safelisted.
However, the design could be even simpler. If I could create multiple Base
Chains, with different Priorities, I could avoid writing Jump statements
altogether:
* Base Chain #1, Priority 0 = Accept Some Things.
* Base Chain #2, Priority 10 = Accept Some Things.
* Base Chain #3, Priority 20 = Accept Some Things.
* Base Chain #4, Priority 30 = Log and Drop Everything Else.
In this way, a packet flows linearly through the rules based on chain priority.
Until it's either Accepted or Dropped. First match wins. I wouldn't need to
code Jumps at all.
Currently this is impossible, because that final Drop in Base #4 overrules the
previous 3 chain's decisions.
And Priority is left without any real purpose. I'm practically limited to 1
base chain per hook. Whether those chains are Priority 0 or 200, all that
actually matters is jumping around, until the packet encounters a Drop.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>