<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - nft masquerade commands make table nat unreadable by iptables-nft"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1748">1748</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>nft masquerade commands make table nat unreadable by iptables-nft
</td>
</tr>
<tr>
<th>Product</th>
<td>iptables
</td>
</tr>
<tr>
<th>Version</th>
<td>git (please indicate commit ID)
</td>
</tr>
<tr>
<th>Hardware</th>
<td>All
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P5
</td>
</tr>
<tr>
<th>Component</th>
<td>iptables
</td>
</tr>
<tr>
<th>Assignee</th>
<td>netfilter-buglog@lists.netfilter.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>ts@ferncast.de
</td>
</tr></table>
<p>
<div>
<pre>Hi,
If I inject a masquerade rule into the nat table by nft I cannot read the
table with iptables-nft (git hash 8bf2bab8eb2e4f5ae2fef859ea7c877662854101 and
also older versions like 1.8.9) anymore till I delete this single rule with nft
tool.
E.g. if I put the below configuration into file postrouting.nft and inject it
via `nft -f postrouting.nft`:
table ip nat {
chain POSTROUTING {
oifname != "br-mailcow" ip saddr 172.22.1.0/24 masquerade
}
}
`iptables -t nat -L` than tells me `iptables v1.8.10 (nf_tables): table `nat'
is incompatible, use 'nft' tool.` If I inject the same rule with iptables-nft,
everything is working fine. I was able to fix this behavior by this patch to
iptables, but I am pretty sure that this is not the right way to do it:
diff --git a/iptables/nft.c b/iptables/nft.c
index 884cc77e..a7086014 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -3931,6 +3931,7 @@ static const char *supported_exprs[] = {
"immediate",
"lookup",
"range",
+ "masq",
};
In my further debugging I found that the rule injected by iptables seems to
have "target" as expression instead of "masq", but this only as a hint for
someone who really knows the code. ;-)
Yesterday morning this "bug" caused a severe problem as libvirt was not able to
read the nat table anymore because I used some nft commands before to insert
some masquerading rules. This also may affect others who update their libvirt
in, e.g., Ubuntu, and have inserted masquerading rules in the nat table via
`nft`.
Best regards,
Thomas</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>