关于 nftables chain 优先级的问题

[yaott2020]

现在有以下规则：

table inet filter2 { # handle 39
        set iplist4 { # handle 3
                type ipv4_addr
        }

        set iplist6 { # handle 4
                type ipv6_addr
        }

        chain filter { # handle 12
                type filter hook input priority filter + 1; policy accept;
                ip saddr @iplist4 accept # handle 13
                ip6 saddr @iplist6 accept # handle 14
                drop # handle 16
        }
}
table ip default_filter { # handle 42
        chain filter { # handle 4
                type filter hook input priority filter; policy accept;
                tcp dport 8092 accept # handle 5
        }
}

若是按上面设置，则无法访问 TCP 8092 端口，去掉 filter2 == filter == drop 规则后，TCP 8092 端口访问正常

请教：priority 设置优先级且数字越小优先级越高，而按照我的设置则无法屏蔽所有端口（除 TCP 8092 外），请问我哪里设置错了

[24owls]

nft(8) -> STATEMENTS -> VERDICT STATEMENT -> accept

Terminate ruleset evaluation and accept the packet. The packet can still be dropped later by another hook, for instance accept in the forward hook still allows to drop the packet later in the postrouting hook, or another forward base chain that has a higher priority number and is evaluated afterwards in the processing pipeline.

注意最后一小句

[plko345]

nftables 好用吗？学了些，一直没用，还在用 iptables

[yaott2020]

那如何终止匹配后面的呢

[yaott2020]

@plko345 比 iptables 复杂一些，不太好学

[24owls]

> 那如何终止匹配后面的呢

没什么特别好的办法，要么把它们放到或连到同一个 base chain 上，要么先在低优先级 chain 上做个 mark 再在高优先级上根据 mark 价格特殊情况

[yaott2020]

@24owls 感觉 accept 这么设置好蠢啊，算了，还是打 mark 再说吧

[yaott2020]

好心累，还是不行

```
table inet default { # handle 47
chain filter { # handle 1
type filter hook input priority filter; policy accept;
tcp dport 8092 meta mark set 0x000000fb # handle 4
}
}
table inet SafeFortress { # handle 49
set iplist4 { # handle 2
type ipv4_addr
flags interval
}

set iplist6 { # handle 3
type ipv6_addr
flags interval
}

chain filter { # handle 1
type filter hook input priority filter + 1; policy accept;
meta mark 0x000000fb return # handle 4
ip saddr @iplist4 accept # handle 5
ip6 saddr @iplist6 accept # handle 6
drop # handle 7
}
}
```

[24owls]

@yaott2020 你上面的配置还有一个更大的问题，这条规则 inet SafeFortress filter drop # handle 7 同时还把对端的 TCP packet 给 drop 了

你还得要么把对端 IP 加到允许的 IP 列表，要么允许 tcp sport 8092 通过，要么允许 ct state { established, related } 通过

[yaott2020]

放弃了。。。还是 iptables 好用