Nft flowtable 22.03.4

For Developers
1

Im confused by conflicting documentation on the web....

Currently the flowtable firewall rule inserted in the forwarding chain is:
'meta l4proto { tcp, udp } flow add @ft'

Surely that should be:
'meta l4proto { tcp, udp } flow offload @ft'

?

2

the web is big, could you be more specific ?

3

Looks right to me.

Compare fw4 -q print with nft list ruleset. Maybe nft is substituting the token on list output.

1 Like
4

Dave you are bang on.

nftables v1.0.2 (Lester Gooch)
'nft list ruleset' yields 'add' after explicitly setting 'offload' in the rule.

I had read somewhere on the nftables wiki that 'add' was for manually adding flows rather than automatically which rely on a conntrack'ed reply being sent. There are discrepancies between different document versions, not sure if early documentation was incorrect or the nftables api was unstable with earlier versions which confused me....either way it is now clear what is occurring.

Thanks for your prompt response.

5

This commit seems to indicate the official syntax changed from offload to add in 2019.

http://git.netfilter.org/nftables/commit/?id=4795a994e2810c63d8da19b5f75854db470e4a6c

6

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.