<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p></p>
<div>
<div>Package: nftables</div>
<div>Version: 0.8-1</div>
<div>Severity: important</div>
</div>
<div><br>
</div>
<div>Dear Maintainer,</div>
<div><br>
</div>
<div><br>
</div>
<div>I use a script to set the rules with nft. It worked well before the</div>
<div>updating today. I don't know what are updated. My (executable) script is</div>
<div><br>
</div>
<div>-------------------</div>
<div>#!/usr/sbin/nft -f</div>
<div><br>
</div>
<div><br>
</div>
<div>flush ruleset</div>
<div>#include "nftables.conf"</div>
<div><br>
</div>
<div># define inner_net = {10.0.0.0/8,10.14.129.0/24,10.110.64.0/24}</div>
<div># ipp:631, mldonkey:4000, mldonkey_http:4080, rpc:111, ftp:21, ssh:22</div>
<div>define tcp_port = {111,22}</div>
<div># 1701:l2tpd, dns:53, ipp:631, mdns:5353</div>
<div>define udp_port = {53,631,5353}</div>
<div># 21688 for mldonkey (TCP) 21688+4 for mldonkey (UDP)</div>
<div>define ml_tcp_port= {21688, 51413}</div>
<div>define ml_udp_port= {21692, 51413}</div>
<div><br>
</div>
<div>add table vnat</div>
<div>add table myfilter</div>
<div>add chain myfilter tcp_chain</div>
<div>add chain myfilter udp_chain</div>
<div><br>
</div>
<div>add chain myfilter myinput {</div>
<div> type filter hook input priority 0; policy drop;</div>
<div> ct state established,related accept;</div>
<div> #ip protocol icmp counter accept ;</div>
<div> ip saddr 127.0.0.1 ip daddr 127.0.0.1 accept;</div>
<div> ct state new tcp flags syn tcp dport $tcp_port jump tcp_chain;</div>
<div> ct state new udp dport $udp_port jump udp_chain;</div>
<div> ct state new tcp flags syn tcp dport $ml_tcp_port accept;</div>
<div> ct state new udp dport $ml_udp_port accept;</div>
<div> ip protocol icmp ip saddr 127.0.0.1 ip daddr 127.0.0.1 accept;</div>
<div>}</div>
<div><br>
</div>
<div><br>
</div>
<div>#add rule myfilter tcp_chain ip saddr $inner_net accept;</div>
<div>add rule myfilter tcp_chain ip saddr 127.0.0.1 ip daddr 127.0.0.1 accept;</div>
<div>add rule myfilter tcp_chain limit rate 5/hour counter;</div>
<div><br>
</div>
<div>#add rule myfilter udp_chain ip saddr $inner_net accept;</div>
<div>add rule myfilter udp_chain ip saddr 127.0.0.1 ip daddr 127.0.0.1 accept;</div>
<div>add rule myfilter udp_chain limit rate 5/hour counter;</div>
<div>----------------------------</div>
<div><br>
</div>
<div>after setting the ruleset with the script, I check the ruleset with</div>
<div>nft list ruleset</div>
<div><br>
</div>
<div>the output is</div>
<div><br>
</div>
<div>table ip vnat {</div>
<div>}</div>
<div>table ip myfilter {</div>
<div><span style="white-space:pre"></span>chain tcp_chain {</div>
<div><span style="white-space:pre"></span>ip saddr 127.0.0.1 ip daddr 127.0.0.1 accept</div>
<div><span style="white-space:pre"></span>limit rate 5/hour counter packets 0 bytes 0</div>
<div><span style="white-space:pre"></span>}</div>
<div><br>
</div>
<div><span style="white-space:pre"></span>chain udp_chain {</div>
<div><span style="white-space:pre"></span>ip saddr 127.0.0.1 ip daddr 127.0.0.1 accept</div>
<div><span style="white-space:pre"></span>limit rate 5/hour counter packets 0 bytes 0</div>
<div><span style="white-space:pre"></span>}</div>
<div><br>
</div>
<div><span style="white-space:pre"></span>chain myinput {</div>
<div><span style="white-space:pre"></span>type filter hook input priority 0; policy drop;</div>
<div><span style="white-space:pre"></span>}</div>
<div>}</div>
<div><br>
</div>
<div>This shows most of rules in the script are not read. Because my policy is 'drop', the net disconnects. I have to set
<div style="font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px;">
the policy 'accept'.</div>
<div style="font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px;">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px;">
<span style="font-size: 12pt;">I think this may be a bug.</span><span style="font-size: 12pt;"> </span><br>
</div>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px;">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px;">
Best regards</div>
<div style="font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px;">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px;">
Lu Wang</div>
<div></div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>-- System Information:</div>
<div>Debian Release: buster/sid</div>
<div> APT prefers testing</div>
<div> APT policy: (500, 'testing')</div>
<div>Architecture: amd64 (x86_64)</div>
<div>Foreign Architectures: i386</div>
<div><br>
</div>
<div>Kernel: Linux 4.13.0-1-amd64 (SMP w/4 CPU cores)</div>
<div>Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8)</div>
<div>Shell: /bin/sh linked to /bin/dash</div>
<div>Init: systemd (via /run/systemd/system)</div>
<div><br>
</div>
<div>Versions of packages nftables depends on:</div>
<div>ii dpkg 1.18.24</div>
<div>ii libc6 2.24-17</div>
<div>ii libgmp10 2:6.1.2+dfsg-1.1</div>
<div>ii libmnl0 1.0.4-2</div>
<div>ii libnftnl7 1.0.8-1</div>
<div>ii libreadline7 7.0-3</div>
<div>ii libxtables12 1.6.1-2+b1</div>
<div><br>
</div>
<div>nftables recommends no packages.</div>
<div><br>
</div>
<div>nftables suggests no packages.</div>
<div><br>
</div>
<div>-- no debconf information</div>
<br>
<p></p>
</div>
</body>
</html>