Sorry for the incomplete configuration.
I have to delete the line “ct state invalid drop” and change the input policy to accept to use apt update, ping, ... .
Even then the ct counter does not change.
conntrack -L is working.
Here is a "nft list table ip filter" output:
I have to delete the line “ct state invalid drop” and change the input policy to accept to use apt update, ping, ... .
Even then the ct counter does not change.
conntrack -L is working.
Here is a "nft list table ip filter" output:
Code:
table ip filter { chain INPUT { type filter hook input priority filter; policy drop; ct state invalid drop ct state { established, related } counter packets 0 bytes 0 accept iifname "lo" accept iifname != "lo" ip saddr 127.0.0.0/8 drop iifname != "lo" ip daddr 127.0.0.0/8 drop ip daddr 10.13.3.15 ip saddr 10.13.3.1 goto ROUTERPI-TO-SMARTHOMEPI ip daddr 10.13.3.15 goto DEVICE-TO-SMARTHOMEPI ip daddr 10.13.12.15 goto IOT-TO-SMARTHOMEPI } chain FORWARD { type filter hook forward priority filter; policy drop; ct state invalid drop ct state { established, related } accept iifname { "device-bridge", "macvlan-device" } oifname { "device-bridge", "macvlan-device" } accept iifname { "iot-bridge", "macvlan-iot" } oifname { "iot-bridge", "macvlan-iot" } accept } chain OUTPUT { type filter hook output priority filter; policy accept; } chain icmp_ipv4 { icmp type echo-request limit rate 5/second accept } chain icmp_ipv6 { icmpv6 type echo-request limit rate 5/second accept } chain dhcp_ipv4 { udp dport 67 accept } chain dhcp_ipv6 { udp dport 547 accept } chain DEVICE-TO-SMARTHOMEPI { meta protocol vmap { ip : jump icmp_ipv4, ip6 : jump icmp_ipv6 } tcp dport 22 accept tcp dport 10000 accept tcp dport 19999 accept tcp dport { 139, 445 } accept udp dport { 137, 138 } accept udp dport 5353 accept udp dport 1900 accept udp dport 123 accept tcp dport 8000 accept } chain ROUTERPI-TO-SMARTHOMEPI { meta protocol vmap { ip : jump icmp_ipv4, ip6 : jump icmp_ipv6 } tcp dport 22 accept udp dport 123 accept tcp dport 8000 accept } chain IOT-TO-SMARTHOMEPI { meta protocol vmap { ip : jump icmp_ipv4, ip6 : jump icmp_ipv6 } meta protocol vmap { ip : jump dhcp_ipv4, ip6 : jump dhcp_ipv6 } udp dport 123 accept tcp dport 8000 accept }}Statistics: Posted by smhrambo — Tue Jul 23, 2024 3:41 pm