1

I'm stuck at configuring nftables.

table bridge filter {
    chain input { type filter hook input priority -200; policy accept;}
    chain forward {
        type filter hook forward priority -200; policy drop;
        ip protocol icmp counter accept;
    }
    chain output { type filter hook output priority 200; policy accept;}

I have a couple of questions. Rule ip protocol icmp counter accept; does not work. Counter showing +1 packet in minute or so and ping not working. What I'm doing wrong?

0

You have first to allow ARP resolution to work. Local IP resolution relies on ARP:

nft add rule bridge filter forward ether type arp accept

Else when trying to ping, arp resolution fails and you get something like this on a node trying to cross the bridge:

# ip neigh show eth0
192.168.1.7 dev eth0  FAILED

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.