Replace flow offload by flow add in wiki
Anthony Ruhier <[email protected]>
| Newsgroups | gmane.comp.security.firewalls.netfilter.general |
|---|---|
| Message-ID | <yw2rcklool64bepdn3kue7yj7xryymdmhjoe72hqujj4xaads4@yzo7qkb452oc> |
Hi,
I was setting up flowtables offloading in my nftables rules, and I got confused
by the wiki page.
In https://wiki.nftables.org/wiki-nftables/index.php/Flowtables, the example
given to offload a flow is using the `flow offload` rule.
If I understood correctly, `flow offload` has been deprecated in favor of `flow
add`. Is it possible to replace any occurrence of `offload` with `add` please?
Also in this example, I got confused with the presence of the conntrack state
rule:
> tcp dport { 80, 443 } ct state established flow offload @f counter
From
https://thermalcircle.de/doku.php?id=blog:linux:flowtables_1_a_netfilter_nftables_fastpath,
checking that the state is established seems unnecessary, as `flow add` will
match only if the conntrack state is "confirmed". If it's correct, could it be
removed for clarity? And even better, add an explanation over when the rule
would be matched.
Thanks,
--
Anthony Ruhier