<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - Flowtable - Bug on devices deinition"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1700#c3">Comment # 3</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - Flowtable - Bug on devices deinition"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1700">bug 1700</a>
from <span class="vcard"><a class="email" href="mailto:nicolasfort1988@gmail.com" title="nicolasfort1988@gmail.com">nicolasfort1988@gmail.com</a>
</span></b>
<pre>So there's no correlation between 'devices' definition in flowtable, and
'iifname' in ruleset?
For example:
vyos@picopc# sudo nft list table ip vyos_filter
table ip vyos_filter {
flowtable ft_test {
hook ingress priority filter
devices = { eth1, eth2 }
}
chain VYOS_FORWARD_filter {
type filter hook forward priority filter; policy accept;
iifname { "eth3", "eth4" } ip protocol udp counter packets 34409310
bytes 51613965000 flow add @ft_test
meta l4proto { tcp, udp } counter packets 2111088123 bytes
3166632184500 accept comment "FWD-filter-10"
}
chain VYOS_INPUT_filter {
type filter hook input priority filter; policy accept;
}
chain VYOS_OUTPUT_filter {
type filter hook output priority filter; policy accept;
}
chain VYOS_FRAG_MARK {
type filter hook prerouting priority -450; policy accept;
ip frag-off & 16383 != 0 meta mark set 0x000ffff1 return
}
}
[edit]
vyos@picopc# sudo conntrack -L | grep -c OFFLOAD
conntrack v1.4.6 (conntrack-tools): 1016 flow entries have been shown.
Seems like 'device' deifnition in flowtables is unnecessary, and what really
matters is interace mather in the rule.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>