0

Problem:

When trying to add nft rules, I keep getting "Error: Could not process rule: No such file or directory"

Example command:

nft add rule netdev filter input ip daddr 10.10.10.10 counter

Troubleshooting:

  • Confirmed "netdev filter" is as listed table with nft list tables
  • Make sure nftables.service was running.
  • The unit file shows /etc/nftables.conf is being used.
  • Running all commands as root.
  • This post recommends setting CONFIG_NF_TABLES_INET=y. How and were do I do this? Its not clear.

System

  • Ubuntu 20.04.2 LTS
  • Kernel 5.4.0-91-generic

Not sure else how to troubleshoot this, the error is very vague. What am I missing? Why can I not add nft rules?

1 Answer 1

1

The netdev address family does not have an input hook, but an ingress hook. Your command might still be valid, but only if you had created a base chain named input first, by e.g.

nft add chain netdev filter input \{ type filter hook ingress device "eth0" priority filter; policy accept; \}

Here, the first filter is the name of the pre-existing netdev filter table. The second filter specifies the type of the chain, and the third filter is the standard name for the normal priority for filter chains.

The recommendation to set CONFIG_NF_TABLES_INET=y would probably also mean using the inet address family instead of netdev unless you have specific need to use the latter.

1
  • 1
    Note that this command will actually fail as is because the detdev address family requires a device specification in addition to the usual stuff, so if the network device is named eth0, the command would be nft add chain netdev filter input '{ type filter hook ingress device "eth0" priority filter; policy accept; }'. You can determine the actual device name using ip link show. Jun 27, 2022 at 15:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .