[Bug 1051] New: nftables DNAT not working

[bugzilla-daemon at netfilter.org]

https://bugzilla.netfilter.org/show_bug.cgi?id=1051

            Bug ID: 1051
           Summary: nftables DNAT not working
           Product: nftables
           Version: unspecified
          Hardware: x86_64
                OS: Gentoo
            Status: NEW
          Severity: critical
          Priority: P5
         Component: kernel
          Assignee: pablo at netfilter.org
          Reporter: andrey.aleksandrovich at googlemail.com

Hi,
The issue is simple, `table nat` with prerouting hooks does not receive
appropriate traffic.
Here is config commands (1.2.3.4 is just a placeholder for the address actually
used here):

# nft add table inet filter
# nft add chain inet filter input { type filter hook input priority 0 \; policy
drop\; }
# nft add rule inet filter input ct state invalid counter drop
# nft add rule inet filter input ct state {established, related} counter accept
# nft add rule inet filter input tcp dport 8080 counter accept
# nft add chain inet filter forward { type filter hook forward priority 0 \;
policy accept\; }
# nft add rule inet filter forward counter
# nft add chain inet filter output { type filter hook output priority 0 \;
policy accept\; }
# nft add rule inet filter output counter
# nft add table nat
# nft add chain nat prerouting { type nat hook prerouting priority 0 \; }
# nft add rule nat prerouting ip daddr 1.2.3.4 tcp dport 80 counter dnat
1.2.3.4:8080
# nft add chain nat postrouting { type nat hook postrouting priority 0 \; }

But the traffic doesn't redirect to 8080 (there is 0 bytes/packets)
# nft list table nat -a -nn
table ip nat {
        chain prerouting {
                type nat hook prerouting priority 0; policy accept;
                ip daddr 1.2.3.4 tcp dport 80 counter packets 0 bytes 0 dnat
1.2.3.4:8080 # handle 3
        }

        chain postrouting {
                type nat hook postrouting priority 0; policy accept;
        }
}

I've searched solution over the net, and find out that it affects not only me:
https://bugs.launchpad.net/ubuntu/+source/nftables/+bug/1503695
http://www.spinics.net/lists/netfilter/msg56390.html
http://permalink.gmane.org/gmane.comp.security.firewalls.netfilter.general/48283

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20160228/1818acd5/attachment.html>