From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Frank Wunderlich <frank-w@public-files.de>
Cc: netfilter@vger.kernel.org
Subject: Re: Re: Re: Re: Re: Re: Re: Flowtable with ppp/bridge
Date: Mon, 10 May 2021 10:24:59 +0200 [thread overview]
Message-ID: <20210510082459.GA23639@salvia> (raw)
In-Reply-To: <trinity-abe9ce42-2ceb-416a-a3e9-b4ecc810df5f-1620629456214@3c-app-gmx-bs56>
On Mon, May 10, 2021 at 08:50:56AM +0200, Frank Wunderlich wrote:
> Hi
>
> > Gesendet: Donnerstag, 06. Mai 2021 um 17:51 Uhr
> > Von: "Pablo Neira Ayuso" <pablo@netfilter.org>
>
> > > > chain FORWARD {
> > > > type filter hook forward priority 0; policy drop;
> > > >
> > > > tcp flags syn tcp option maxseg size set rt mtu
> > > > ct state vmap { established : jump FORWARD_established, related : jump FORWARD_established, new : jump FORWARD_new }
>
> tried this way, seems to work so far, i have only problem on removing my ruleset with iptables (have this to reset my complete firewall, not only nft).
>
> iptables -X
> iptables v1.8.2 (nf_tables): CHAIN_USER_DEL failed (Device or resource busy): chain FORWARD_known
>
> i guess iptables cannot delete chain cause it is linked by ctstate vmap any idea?
In iptables, you have to flush a chain (-F) before you can delete it.
Anyway, once you step in to use nftables, it is better if you use
native nftables commands to operate, such as:
nft flush ruleset
> is order important of defined chains? maybe i can move the 2 new
> forward-chains below old with "ct state vmap"
Not sure what you mean, could you provide an example?
next prev parent reply other threads:[~2021-05-10 8:24 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-04-26 15:30 Flowtable with ppp/bridge Frank Wunderlich
2021-04-26 17:29 ` Pablo Neira Ayuso
2021-04-26 17:51 ` Frank Wunderlich
2021-04-26 17:57 ` Pablo Neira Ayuso
2021-04-26 18:08 ` Frank Wunderlich
2021-04-27 23:49 ` Pablo Neira Ayuso
2021-04-28 8:07 ` Frank Wunderlich
2021-04-28 17:26 ` Frank Wunderlich
2021-04-29 13:59 ` Aw: " Frank Wunderlich
2021-05-02 13:51 ` Frank Wunderlich
2021-05-02 22:11 ` Pablo Neira Ayuso
2021-05-03 18:56 ` Aw: " Frank Wunderlich
2021-05-03 21:32 ` Pablo Neira Ayuso
2021-05-04 10:54 ` Aw: " Frank Wunderlich
2021-05-04 11:42 ` Pablo Neira Ayuso
2021-05-05 8:55 ` Aw: " Frank Wunderlich
2021-05-05 22:55 ` Pablo Neira Ayuso
2021-05-06 9:53 ` Aw: " Frank Wunderlich
2021-05-06 15:51 ` Pablo Neira Ayuso
2021-05-10 6:50 ` Aw: " Frank Wunderlich
2021-05-10 8:24 ` Pablo Neira Ayuso [this message]
2021-05-10 9:00 ` Aw: " Frank Wunderlich
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210510082459.GA23639@salvia \
--to=pablo@netfilter.org \
--cc=frank-w@public-files.de \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.