Nftables.d snippet rule not inserted

[jsalatiel]

I am trying to insert a rule to the chain reject_to_wan. From the snippets documentation, I should be able to do it by creating a file under /usr/share/nftables.d/chain-pre/reject_to_wan/log.nft.
The content of the file is:

limit rate 1/second burst 5 packets counter log prefix "reject2wan: "

When i reload the file I can see
Automatically including '/usr/share/nftables.d/chain-pre/reject_to_wan/log.nft'

But unfortunately my chain still has only the default rule there.

	chain reject_to_wan {
		oifname { "pppoe-wan1", "lan4" } counter jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
	}

What am i doing wrong?

[efahl]

Oops, original post completely misread your post, here's a complete rewrite:

Some chains do not have %includes in them, reject_to_wan is one of them.

More details than you ever wanted...

Nftables snippets chain option is not taken into account

Hi everyone! After migrating from fw3 to fw4, I need to add custom log filters so they can be parsed by my ELK stack easily. To do so, I've read this doc and I realized that not all chain are taken into account (or I misread the doc). For example, I'd like to customize the drop_from_wan to log dropped packets coming from my WAN: ... config include option type 'nftables' option path '/etc/test.nft' option position 'chain-post' option chain 'drop_from_wan' Running fw4 does not show any…

[efahl]

Here's a complete set from my notes:

There are four chain rendering sections where these calls to fw4.includes are missing:

1. {verdict}_from_{zone}
2. {verdict}_to_{zone}
3. helper_{zone}
4. notrack_{zone}
5. Terminal chains:
   handle_reject - unconditionally rendered jump-to-rule
   syn_flood - conditionally rendered if (fw4.default_option("synflood_protect") && fw4.default_option("synflood_rate"))

Notable: raw_prerouting has no chain-pre includes.

Solution is to put some appropriate command in /etc/firewall.user (see below), along with enabling that file in /etc/config/firewall with

 config include
         option enabled '1'
         option type 'script'
         option path '/etc/firewall.user'
         option fw4_compatible '1'

Edit - I'm back with a possible insert command:

handle=$(nft -a list chain inet fw4 reject_from_wan | awk '/jump handle_reject /{print $(NF)}')
nft insert rule inet fw4 reject_from_wan position $handle ' limit rate 1/second burst 5 packets counter log prefix "reject2wan: " '