1

Is it possible to define multiple hooks in nftables chain or is there any other elegant way how to prevent duplicationg the rules inside (without include from another file)?

table inet raw {
    chain mangle {
        type filter hook { prerouting, input, output, forward } priority -190; policy accept;

        ct state invalid counter drop
    }
}

1 Answer 1

2

No, a base chain has only one hook into netfilter.

But within the same table, you can call the same user chain from each base chain. Here's an example, with extra counters showing their state after a single ping -c1 127.0.0.1:

table inet myfilter {
    chain mypreroutingchain {
        type filter hook prerouting priority filter; policy accept;
        counter packets 2 bytes 168
        jump myuserchain
    }

    chain myinput {
        type filter hook input priority filter; policy accept;
        counter packets 2 bytes 168
        jump myuserchain
    }

    chain myforward {
        type filter hook forward priority filter; policy accept;
        counter packets 0 bytes 0
        jump myuserchain
    }

    chain myoutput {
        type filter hook output priority filter; policy accept;
        counter packets 2 bytes 168
        jump myuserchain
    }

    chain mypostrouting {
        type filter hook postrouting priority filter; policy accept;
        counter packets 2 bytes 168
        jump myuserchain
    }

    chain myuserchain {
        oif "lo" counter packets 4 bytes 336
        iif "lo" counter packets 4 bytes 336
        counter packets 8 bytes 672
        ct state invalid counter packets 0 bytes 0 drop
    }
}

the same user chain myuserchain was called 8 times for the ping:

outgoing echo-request: from output+postrouting, incoming echo request from prerouting+input, then again the same with echo-reply.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .