nftables table and chain priority

Question

I have a problem with my nftables setup.

I have two tables, each one has a chain with the same hook but a different name and priority.

The tables are in different files which are loaded by an include argument.

Because of the priority, I would think that the VPN-POSTROUTING chain will be executed before the INTERNET chain. But in my setup, the INTERNET chain is executed first.

table ip nat {
        chain INTERNET {
                type nat hook postrouting priority srcnat + 1; policy accept;
                oifname br2 masquerade
        }
}

table ip vpn {
        chain VPN-POSTROUTING {
                type nat hook postrouting priority srcnat - 1; policy accept;
                oifname br2 ip saddr 10.0.0.0/24 ip daddr 192.168.0.0/24 accept
        }
}

where is my mistake?

Edit: I changed the rules and add all chains to the same table, with the same result.

In the next step, I followed A.B.'s advice and add counters and logs to the rules.

The order of the chains corresponds to the priority, but the accept rule for the VPN is not triggered.

When I add the VPN accept rule to the INTERNET chain, right before the masquerade rule, it works like expected.

Answer 1

Historically there used to be one NAT chain in a given hook (prerouting, input, output, ...). Executing a nat statement or simply accept-ing the packet being terminal for the chain, with a single chain it was also ending treatment within the hook. With nftables allowing to use more than one chain in the same hook, terminating a chain will just continue to the next chain. So if the first chain doesn't do anything (by accept-ing), the next chain gets its chance to do it instead, which is not what is intended.

To solve this, the first chain (or any other chain) can leave a message passed to each next chain so it can act upon it: set a mark (an arbitrary value) for the next chain to change its behavior.

Instead of accept which has zero effect (leaving the chain VPN-POSTROUTING empty also executes the default policy: accept), set a mark. So replace the rule in VPN-POSTROUTING with this one instead:

nft add rule ip vpn VPN-POSTROUTING oifname br2 ip saddr 10.0.0.0/24 ip daddr 192.168.0.0/24 mark set 0xdeaf

When this mark is set, it can then be used on the other chain to change behavior by not executing remaining rules. Insert this rule first in ip nat INTERNET:

nft insert rule ip nat INTERNET mark 0xdeaf accept