Linux Netfilter discussions
 help / color / mirror / Atom feed
From: Florian Westphal <fw@strlen.de>
To: "Marek Greško" <mgresko8@gmail.com>
Cc: Florian Westphal <fw@strlen.de>, netfilter@vger.kernel.org
Subject: Re: nftables and connection tracking
Date: Thu, 2 Jul 2020 00:48:20 +0200	[thread overview]
Message-ID: <20200701224820.GA29407@breakpoint.cc> (raw)
In-Reply-To: <CAChjPdSFWc=XpxX_Nw40hBMyFpyWNyEvru1k1WJpKLZE-7CcfQ@mail.gmail.com>

Marek Gre¨ko <mgresko8@gmail.com> wrote:
> please is it a bug the rules did not work in the raw table or was it
> my configuration error?

Config error.

> How is it possible that using iptables-nft the rules are added to the
> raw table and it is working?

iptables-nft and fntables are not the same.
-j CT works with 'connection tracking templates',
but the nft equivalent sets the helper directly.

So, for iptables (and iptables-nft), the rule needs to be
executed before conntrack lookup.  With nft it has to be done
after conntrack lookup.

  reply	other threads:[~2020-07-01 22:48 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-06-21  5:54 nftables and connection tracking Marek Greško
2020-06-21  8:06 ` Florian Westphal
     [not found]   ` <CAChjPdQtKBGuUvdveCVc5kmhA+fgP4DUDNKhNd11KUVCKNUZLg@mail.gmail.com>
     [not found]     ` <20200621090142.GL26990@breakpoint.cc>
2020-06-21  9:39       ` Marek Greško
2020-06-21 10:45         ` Florian Westphal
2020-06-21 11:33           ` Marek Greško
2020-07-01 20:01           ` Marek Greško
2020-07-01 22:48             ` Florian Westphal [this message]
2020-07-02 19:33               ` Marek Greško
2020-07-02 19:47                 ` Pablo Neira Ayuso
     [not found]                   ` <CAChjPdQb5wUP7Qbz=D-0jg-YFC0cWgV4oPJQD9-G7evi3SupAw@mail.gmail.com>
     [not found]                     ` <YUk8dCSHCUcKn+Xy@salvia>
     [not found]                       ` <CAChjPdREO=jtTNGc32H3mv+Zv8AHKbujb_a8=tkwC0+b2sbVCQ@mail.gmail.com>
2021-09-24  5:21                         ` Fwd: " Marek Greško
2021-09-24  7:19                           ` Daniel
2020-06-22 12:06 ` Pablo Neira Ayuso
2020-06-22 17:18   ` Marek Greško
2020-06-22 21:35     ` Marek Greško

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200701224820.GA29407@breakpoint.cc \
    --to=fw@strlen.de \
    --cc=mgresko8@gmail.com \
    --cc=netfilter@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox