Re: [PATCH nft v6 0/3] doc: miscellaneous improvements

[Florian Westphal <fw@strlen.de>]

Christoph Anton Mitterer <mail@christoph.anton.mitterer.name> wrote:
> On Wed, 2025-10-29 at 12:28 +0100, Florian Westphal wrote:
> > 
> > What about this:
> >   Thus, if any base chain uses drop as its policy, the same base
> > chain (or a
> >   regular chain directly or indirectly called by it) must contain at
> > least one
> >   *accept* rule to avoid all traffic from getting dropped.
> 
> Isn't that still effectively the same?

?

> I mean the whole summary chapter explains things from the view of a
> single packet, as was also the case for my last version of this
> sentence:
> > +  Thus, if any base chain uses drop as its policy, the same base chain (or any
> > +  regular chain directly or indirectly called by it) must accept a packet or it
> > +  is ensured to be ultimately dropped by it.

Whats that supposed to convey?

I will take your version (because I tire to iterate this again and again
but I think my version is better.

drop policy and no accept rule -> thats NOT what you want.
And thats what the 'all traffic' in my version intends to say.

> Your wording changes this now to refer to "all traffic", which I think
> make an unnecessary specialised case, namely that, where all packets
> would be dropped, unless there's at least one accept rule.

Isn't that a rather important point?

> The typical firewalling case is however that for most packets (that
> might end up on the system) there actually is no single rule that would
> accept them and only some of them get accept.

I would say most are accepted.

> > > IMO it doesn't make things easier for a beginner, if one basically
> > > has to read through everything to find all information.
> > 
> > I added a reference.  Also keep in mind that nftables will already
> > tell
> > you about terminal statement not at end.
> > 
> > nft add rule ip f c drop counter
> > Error: Statement after terminal statement has no effect
> 
> Sure. I know.
> 
> Is it still mentioned somewhere that "comment" is an exception to the
> rule?

Its not an exception, comment is not a statement.  Its isn't
executed/evaluated.

Its no different than

.... accept # do this

... except that "# do this" won't be sent to kernel and not included
when running 'list ruleset' and so on.