bugzilla-daemon at netfilter.org
2017-Aug-15 22:05 UTC
[Bug 1168] New: type nat hook output doesn't work anymore
https://bugzilla.netfilter.org/show_bug.cgi?id=1168 Bug ID: 1168 Summary: type nat hook output doesn't work anymore Product: nftables Version: unspecified Hardware: x86_64 OS: All Status: NEW Severity: normal Priority: P5 Component: kernel Assignee: pablo at netfilter.org Reporter: maxime.deroucy at gmail.com In may I made some tests on nftables : https://www.craoc.fr/articles/nftables/ Then the following rule was working. ``` table ip iptest { chain outputnat { type nat hook output priority 0; policy accept; ip protocol icmp log prefix "OUTPUT NAT IP: " } } ``` As I get the following I my logs : ``` … OUTPUT NAT IP: IN … … ``` Today (15/08/2017) I wanted to replace the following iptables rule : ``` iptables -t nat -A OUTPUT -d … -p tcp --dport 80 -m owner \! --uid-owner nobody -j REDIRECT --to-port 12345 ``` I tried : ``` table ip testtable { chain testchain { type nat hook output priority 0; policy accept; ip daddr … tcp dport 80 meta skuid != nobody redirect to 12345 } } ``` But it didn't worked. I tried the tests I did back in may but "OUTPUT NAT IP" doesn't show up anymore in my logs. I tried many things and nothing worked… It seems the "type nat hook output" doesn't work anymore. To reproduce : ``` root at max-laptop # nft add table ip testtable root at max-laptop # nft add chain testtable testchain \{ type nat hook output priority 0 \; \} root at max-laptop # nft add rule testtable testchain log prefix TEST root at max-laptop # ping -c 3 gateway root at max-laptop # journalctl -e -k | grep TEST ``` Current result : no log matching TEST Expected result : 1 log line matching TEST I am using Archlinux ``` % uname -a Linux max-laptop 4.12.6-1-ARCH #1 SMP PREEMPT Sat Aug 12 09:16:22 CEST 2017 x86_64 GNU/Linux % nft -v nftables v0.7 (Scrooge McDuck) ``` -- You are receiving this mail because: You are watching all bug changes. -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20170815/d5db0f6b/attachment.html>
bugzilla-daemon at netfilter.org
2017-Aug-15 22:05 UTC
[Bug 1168] type nat hook output doesn't work anymore
https://bugzilla.netfilter.org/show_bug.cgi?id=1168 Maxime de Roucy <maxime.deroucy at gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |maxime.deroucy at gmail.com -- You are receiving this mail because: You are watching all bug changes. -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20170815/dcc96af3/attachment.html>
Reasonably Related Threads
- [Bug 1155] New: arp forward filter doesn't work
- [Bug 1105] New: masquerade fully broken when no prerouting chain is created
- [Bug 1150] New: Iptables fails to match rules with malloc perturberation activated
- RSqlite UPDATE command problem
- Python/sqlite date time problems.