[Bug 1399] New: tables/chains priority doesn't work

bugzilla-daemon at netfilter.org bugzilla-daemon at netfilter.org
Sun Jan 19 11:37:05 CET 2020


            Bug ID: 1399
           Summary: tables/chains priority doesn't work
           Product: nftables
           Version: unspecified
          Hardware: x86_64
                OS: Debian GNU/Linux
            Status: NEW
          Severity: enhancement
          Priority: P5
         Component: kernel
          Assignee: pablo at netfilter.org
          Reporter: david at hajes.org

running latest Debian 10 in VPS/KVM - nftables v0.9.2 (Scram)

nftables are initialized by scripts. I have following tables/chains

table ip nat {
    set bad_ip {
        type ipv4_addr

    chain prerouting {
        type nat hook prerouting priority dstnat; policy accept;
        meta nftrace set 1 ip saddr @bad_ip tcp dport { 80, 443 } redirect to

table filter {
        chain prerouting {type filter hook prerouting priority -150;}
        chain input {type filter hook input priority 0; policy drop;}
        chain output {type filter hook output priority 0; policy drop;}

chain input {
        type filter hook input priority filter; policy drop;
        iifname "lo" accept
        ct state established,related accept
        ct state new ip daddr $ip_external tcp sport 1024-65535 tcp dport { 22,
80, 443, 8080 } accept

there is more rules but this is for simplicity. I am trying to achieve a
redirect of blocked IPs/CIDR to port 8080.

If I understand correctly "nat prerouting" is before routing decision and thus
before "filter input".

I used "nft -nn monitor trace" and "nat prerouting" is ignored and "filter
input" is executed.

I wonder what is going on, documentation is sparse...nft doesn't complain about
added rules but they are not executed.

any suggestion, please?



You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200119/313afbe1/attachment.html>

More information about the netfilter-buglog mailing list