Skip to content

Unexpected configuration in the nftables rules generated by auto-redirect #79

Description

@Akariln

For the following nftables snippet generated by auto-redirect,
the rule tcp option mptcp exists counter packets 0 bytes 0 drop
maybe an unintended and unnecessary rule, considering the UDP and ICMP context.

        chain output_udp_icmp {
                type route hook output priority mangle; policy accept;
                meta l4proto != { icmp, udp, ipv6-icmp } return
                meta mark 0x00002024 counter packets 0 bytes 0 return
                ct mark 0x00002024 counter packets 0 bytes 0 return
                ip daddr @inet4_local_address_set counter packets 0 bytes 0 return
                ip6 daddr @inet6_local_address_set counter packets 0 bytes 0 return
                tcp option mptcp exists counter packets 0 bytes 0 drop
                meta mark set 0x00002023 ct mark set meta mark counter packets 0 bytes 0 return
        }

Related commit b49e63f

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions