[Bug 1399] New: tables/chains priority doesn't work

[bugzilla-daemon at netfilter.org]

https://bugzilla.netfilter.org/show_bug.cgi?id=1399

            Bug ID: 1399
           Summary: tables/chains priority doesn't work
           Product: nftables
           Version: unspecified
          Hardware: x86_64
                OS: Debian GNU/Linux
            Status: NEW
          Severity: enhancement
          Priority: P5
         Component: kernel
          Assignee: pablo at netfilter.org
          Reporter: david at hajes.org

running latest Debian 10 in VPS/KVM - nftables v0.9.2 (Scram)

nftables are initialized by scripts. I have following tables/chains


table ip nat {
    set bad_ip {
        type ipv4_addr
    }

    chain prerouting {
        type nat hook prerouting priority dstnat; policy accept;
        meta nftrace set 1 ip saddr @bad_ip tcp dport { 80, 443 } redirect to
:8080
    }
}


table filter {
        chain prerouting {type filter hook prerouting priority -150;}
        chain input {type filter hook input priority 0; policy drop;}
        chain output {type filter hook output priority 0; policy drop;}
}


chain input {
        type filter hook input priority filter; policy drop;
        iifname "lo" accept
        ct state established,related accept
        ct state new ip daddr $ip_external tcp sport 1024-65535 tcp dport { 22,
80, 443, 8080 } accept
}

there is more rules but this is for simplicity. I am trying to achieve a
redirect of blocked IPs/CIDR to port 8080.

If I understand correctly "nat prerouting" is before routing decision and thus
before "filter input".

I used "nft -nn monitor trace" and "nat prerouting" is ignored and "filter
input" is executed.

I wonder what is going on, documentation is sparse...nft doesn't complain about
added rules but they are not executed.

any suggestion, please?


Regards

David

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200119/313afbe1/attachment.html>