1

My understanding from reading is that once a rule matches, no further rules are evaluated. However; my experience with the following example seems to indicate otherwise. Looking for some clarity on this.

table netdev retag {
    chain tagin {
            type filter hook ingress devices = $lan priority -149; policy accept;
            
            ip saddr 10.0.0.0/8 ip daddr 10.0.0.0/8 ip dscp set af21 counter;
            
            ip saddr 10.0.1.0/24 ip daddr 10.0.2.0/24 ip dscp set af31 counter;
    }
}

If the above statement was true then "nft list ruleset" should show hits against the first rule and 0 hits against the second rule since the first rule would always match before the second rule. However; see hits against both. Am I missing something silly here?

1 Answer 1

0

Some actions, such as accept, drop, reject prevent further rule processing.

Other actions, such as counter, log perform their task and continue to the next rule.

In this slightly modified example I added accept to the first rule, this will prevent further evaluation.

table netdev retag {
    chain tagin {
            type filter hook ingress devices = $lan priority -149; policy accept;
            
            ip saddr 10.0.0.0/8 ip daddr 10.0.0.0/8 ip dscp set af21 counter accept;
            
            ip saddr 10.0.1.0/24 ip daddr 10.0.2.0/24 ip dscp set af31 counter;
    }
}
2
  • Thank you. This was the answer I was looking for.
    – Emme
    Jan 16, 2023 at 18:39
  • Note that reject statement does not stop further rule processing, only verdict statements can stop it. Apr 10 at 21:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .