Replace flow offload by flow add in wiki

Replace flow offload by flow add in wiki

[Anthony Ruhier]

Hi,
I was setting up flowtables offloading in my nftables rules, and I got confused
by the wiki page.

In https://wiki.nftables.org/wiki-nftables/index.php/Flowtables, the example
given to offload a flow is using the `flow offload` rule.

If I understood correctly, `flow offload` has been deprecated in favor of `flow
add`. Is it possible to replace any occurrence of `offload` with `add` please?

Also in this example, I got confused with the presence of the conntrack state
rule:

> tcp dport { 80, 443 } ct state established flow offload @f counter

From
https://thermalcircle.de/doku.php?id=blog:linux:flowtables_1_a_netfilter_nftables_fastpath,
checking that the state is established seems unnecessary, as `flow add` will
match only if the conntrack state is "confirmed". If it's correct, could it be
removed for clarity? And even better, add an explanation over when the rule
would be matched.

Thanks,
--
Anthony Ruhier

Re: Replace flow offload by flow add in wiki

[Pablo Neira Ayuso]

On Fri, Apr 04, 2025 at 05:12:03PM +0200, Anthony Ruhier wrote:
> Hi,
> I was setting up flowtables offloading in my nftables rules, and I got confused
> by the wiki page.
> 
> In https://wiki.nftables.org/wiki-nftables/index.php/Flowtables, the example
> given to offload a flow is using the `flow offload` rule.
> 
> If I understood correctly, `flow offload` has been deprecated in favor of `flow
> add`. Is it possible to replace any occurrence of `offload` with `add` please?
> 
> Also in this example, I got confused with the presence of the conntrack state
> rule:
> 
> > tcp dport { 80, 443 } ct state established flow offload @f counter
> 
> From
> https://thermalcircle.de/doku.php?id=blog:linux:flowtables_1_a_netfilter_nftables_fastpath,
> checking that the state is established seems unnecessary, as `flow add` will
> match only if the conntrack state is "confirmed". If it's correct, could it be
> removed for clarity? And even better, add an explanation over when the rule
> would be matched.

For the record, I have updated this.

Thanks.