Re: nft for bridge.

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Mon, Aug 18, 2025 at 05:35:49PM +0530, ratheesh kannoth wrote:
> hi,
> 
> inet offload is working fine for me.
> ++++++++++++++++++++++++
> /etc/nftables/inet.nft
> 
> table inet x {
> 
>      flowtable f {
>         hook ingress priority 0
>         devices = { eth0, sdp1-0 }
>         flags offload;
>      }
> 
>     chain forward {
>         type filter hook forward priority 0; policy accept;
>         ct state { established, related } flow add @f
>     }
> }
> ++++++++++++++++++
> But bridge nft fails. Could you help with correct configuration?  i
> have already enabled below config
> CONFIG_NF_TABLES_BRIDGE=y
> CONFIG_NF_CONNTRACK_BRIDGE=y
> 
> 
> /etc/nftables/ibridge-raw.nft
> --------------
> table bridge x {
> 
>      flowtable f {
>         hook ingress priority 0
>         devices = { br0  }
>         flags offload;
>      }
> 
>     chain forward {
>         type filter hook forward priority 0; policy accept;
>         ct state { established, related } flow add @f
>     }
> }
> ~# nft -f /etc/nftables/ipv4-raw.nft
> /etc/nftables/ipv4-raw.nft:7:16-16: Error: Could not process rule: No
> such file or directory
>      flowtable f {
>                ^
> /etc/nftables/ipv4-raw.nft:15:43-53: Error: Could not process rule: No
> such file or directory
>         ct state { established, related } flow add @f
>                                           ^^^^^^^^^^^

No flowtable support for the bridge family yet, sorry.