I'm experimenting with stateless NAT using nftables. On the page about statelessly mangling protocol fields, the author says:

Keep in mind the interactions with conntrack, flows with mangled traffic must be untracked

Out of curiosity, what are some of the bad things that can happen if I fail to do this? I can't seem to find any information on this point.


Connection tracking starts before the mangle table is processed, so the tracked connection would not match the mangled packets, making it useless at best or blocking connectivity at worst.

  • Hi Michael, thanks for your answer. Could you clarify something for me: if I have a rule in nftables that says "ip daddr ip daddr set", are you saying it's the "mangle" table that performs the actual rewriting, regardless of how my nftables chain is configured (hooks, priorities, etc)? – Einheri Jan 11 at 9:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.