Why does adding a counter queue to my Netfilter chain break my VM?

Question

I'm configuring Netfilter Tables to queue packets to and from the userspace, and the table configuration I have so far looks like:

table inet filter {

        # protocols to allow
        set allowed_protocols {
                type inet_proto
                elements = { icmp, icmpv6 }
        }

        # interfaces to accept any traffic on
        set allowed_interfaces {
                type ifname
                elements = { "lo" }
        }

        # services to allow
        set allowed_tcp_dports {
                type inet_service
                elements = { ssh, 9090 }
        }

        # this chain gathers all accept conditions
        chain allow {
                ct state established,related accept

                meta l4proto @allowed_protocols accept
                iifname @allowed_interfaces accept
                tcp dport @allowed_tcp_dports accept
        }

        # base-chain for traffic to this host
        chain INPUT {
                type filter hook input priority filter + 20
                policy accept

                jump allow
                reject with icmpx type port-unreachable
        }

        chain input {
                type filter hook input priority 0;
        }

        chain forward {
                type filter hook forward priority 0;
        }

        chain output {
                type filter hook output priority 0;
        }
}

So far, this seems to load fine with nft -f.

However, when I run either of these commands...

nft add inet filter input counter queue num 0

or

nft add inet filter output counter queue num 1

...my VM completely stops responding to input, and when I terminate the connection and vagrant reload, I'm told my VM has to be forcefully shut down before it can reboot. Any help on how I can properly configure these queues would be appreciated!

OS: Linux fedora 5.19.8-200.fc36.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Sep 8 19:02:21 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

Vagrant: Vagrant 2.3.0

Answer 1

Try bypass so packets are accepted if your application not listen on queue

nft add inet filter input counter queue num 0 bypass

Read this https://wiki.nftables.org/wiki-nftables/index.php/Queueing_to_userspace