Re: [PATCH nft v6 0/3] doc: miscellaneous improvements

[Florian Westphal <fw@strlen.de>]

Christoph Anton Mitterer <mail@christoph.anton.mitterer.name> wrote:
> IMO that makes things a bit more convoluted, first explaining who can
> call who, then where evaluation continues, then again explaining who
> can call who.

I swapped the two sentences.

> I would however suggest to reconsider in prarticular "all traffic will
> be blocked".
> "all traffic" is... well "all traffic"... but the decision is just
> about one packet, ain't it?
> Also "blocked" is IMO a bit fuzzy. Is the term used before? I'd rather
> interpret it as some generic term that could be either drop or reject
> or similar, but here the example was particularly about when any chain
> uses drop as policy.

What about this:
  Thus, if any base chain uses drop as its policy, the same base chain (or a
  regular chain directly or indirectly called by it) must contain at least one
  *accept* rule to avoid all traffic from getting dropped.

> IMO it doesn't make things easier for a beginner, if one basically
> has to read through everything to find all information.

I added a reference.  Also keep in mind that nftables will already tell
you about terminal statement not at end.

nft add rule ip f c drop counter
Error: Statement after terminal statement has no effect

> Als, "or a user-defined", ain't the base chains user-defined,
> too?

Thanks, user-defined is iptables-legacy lingo (base chains always
exist), old habit.