1

I have two output chains like this:

chain OUT {
    type filter hook output priority 0; policy accept;
    ct state established,related accept
    oif "lo" counter packets 0 bytes 0 accept
    ip protocol icmp counter packets 3 bytes 252 drop
    counter packets 0 bytes 0 log drop
}

chain ping {
    type filter hook output priority -10; policy accept;
    ct state established,related accept
    ip protocol icmp counter packets 3 bytes 252 accept
}

ping chain has lower priority of -10 so packets first traverse through this chain and are accepted. Why those accepted icmp packets are next dropped in OUT chain ? I want temporarily enable and disable rule like in this example. How to achieve this ?

nftables: 0.9.2-2
kernel: 5.3.9-3

3
  • It is not clear what you are trying to achieve. Please edit question, to make it clear. Nov 30, 2019 at 19:10
  • 1
    Hah! I encountered the same question a week or so ago; you can see the answer at unix.stackexchange.com/questions/551158/…. The tl;dr is that an accept verdict is only valid for the current chain, and does not prevent a packet from traversing other chains. You can only make things more restrictive, not less restrictive.
    – larsks
    Nov 30, 2019 at 19:17
  • @larsks Thank you. I don't understand this nft behavior but seems it is correct answer and my possible solution for this problem is to make own chain without any hook and jump to this chain.
    – EdiD
    Dec 1, 2019 at 10:31

0

Browse other questions tagged .