LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 11-30-2018, 04:00 AM   #1
keithwilliamsnp
LQ Newbie
 
Registered: Nov 2018
Posts: 1

Rep: Reputation: Disabled
nft chain priority and policy


Debian Stretch, nft version 0.9.0-1 kernel 4.9.0-8-amd64

Am finding behaviour in added chains a bit different to that expected from reading all the documentation.

I have chain

input {type filter hook input priority 0; policy drop;}

This carried most of the firewall rules. I then added another
chain

testpr {type filter hook input priority -1;}

I cut and pasted the rule to accept ftp from the input chain (where it had been working) into the testpr chain.
ftp was blocked. The packets should have traversed testpr first, been accepted before, if necessary entering input chain. This was obviously not happening.
I tried swapping the priorities which, as expected, put the testpr chain after the input chain and so caused the ftp packets to be dropped.
The only way I could get it to work was to change the input policy, but then, of course, that gave a policy of accept so the testpr chain was irrelevant. As any packet not specifically dropped would be accepted, defeating the purpose of a firewall.
I had the same result after changing the testpr to a non-base chain.
Any suggestions please?
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
What's wrong: -X requires a chain and a policy user9876 Linux - Networking 2 11-17-2013 04:23 PM
X: warning; priority set to -1 instead of requested priority 0 HitmanX Linux - Newbie 5 12-13-2010 11:09 AM
iptables good packet chain (instead of bad packet chain) win32sux Linux - Security 6 11-06-2008 06:02 AM
Iptable-can we Set priority for rules in chain? Santoshkb Linux - Networking 5 12-26-2007 12:51 AM
process priority,nice -- small question regarding high/low priority values beeblequix Linux - Newbie 1 10-11-2006 10:22 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 09:22 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration