I have a problem with my nftables setup.
I have two tables, each one has a chain with the same hook but a different name and priority.
The tables are in different files which are loaded by an include argument.
Because of the priority, I would think that the VPN-POSTROUTING chain will be executed before the INTERNET chain. But in my setup, the INTERNET chain is executed first.
table ip nat {
chain INTERNET {
type nat hook postrouting priority srcnat + 1; policy accept;
oifname br2 masquerade
}
}
table ip vpn {
chain VPN-POSTROUTING {
type nat hook postrouting priority srcnat - 1; policy accept;
oifname br2 ip saddr 10.0.0.0/24 ip daddr 192.168.0.0/24 accept
}
}
where is my mistake?
Edit: I changed the rules and add all chains to the same table, with the same result.
In the next step, I followed A.B.'s advice and add counters and logs to the rules.
The order of the chains corresponds to the priority, but the accept rule for the VPN is not triggered.
When I add the VPN accept rule to the INTERNET chain, right before the masquerade rule, it works like expected.