0

I was following tutorial at https://wiki.nftables.org/wiki-nftables/index.php/Main_Page

Here is what I did.

#uname -a
Linux delor 4.9.0-0.bpo.6-amd64 #1 SMP Debian 4.9.88-1+deb9u1~bpo8+1 (2018-05-13) x86_64 GNU/Linux

# sudo nft add table ip filter
# sudo nft add chain ip filter output { type filter hook input priority 0 \; }
# sudo nft add chain ip filter input { type filter hook input priority 0 \; }
# sudo nft add rule filter output ip daddr 8.8.8.8 counter
# ping -c 1 8.8.8.8
# sudo nft -nn list table filter

table ip filter {
    chain output {
            type filter hook input priority 0; policy accept;
            ip daddr 8.8.8.8 counter packets 0 bytes 0
    }

    chain input {
            type filter hook input priority 0; policy accept;
    }
}

We see that the tables are set up (as shown in the tutorial). However the counter did not increase.

Did I miss something? Was I supposed to do something else to enable it?

1

Your output chain is using the input hook. So it's actually a second chain working for input. Its name doesn't matter. What does matter is its hook: input.

Use instead:

# sudo nft add chain ip filter output { type filter hook output priority 0 \; }
  • Opps a cut and paste error. Thanks. I fixed it, it now works. – ctrl-alt-delor Jun 15 '19 at 20:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.