Skip to content

Unexpected configuration in the nftables rules generated by auto-redirect #79

Description

@Akariln

For the following nftables snippet generated by auto-redirect,
the rule tcp option mptcp exists counter packets 0 bytes 0 drop
maybe an unintended and unnecessary rule, considering the UDP and ICMP context.

        chain output_udp_icmp {
                type route hook output priority mangle; policy accept;
                meta l4proto != { icmp, udp, ipv6-icmp } return
                meta mark 0x00002024 counter packets 0 bytes 0 return
                ct mark 0x00002024 counter packets 0 bytes 0 return
                ip daddr @inet4_local_address_set counter packets 0 bytes 0 return
                ip6 daddr @inet6_local_address_set counter packets 0 bytes 0 return
                tcp option mptcp exists counter packets 0 bytes 0 drop
                meta mark set 0x00002023 ct mark set meta mark counter packets 0 bytes 0 return
        }

Related commit b49e63f

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions