Implicit add conflicts with declarative add

S Egbert <[email protected]> Wed, 20 Aug 2025 13:39:11 -0500
Newsgroups gmane.comp.security.firewalls.netfilter.general
Message-ID <[email protected]>
Take the following NFT snippet:

     add table ip table_id             # imperative
     add chain ip table_id chain_id    # imperative???

     table ip table_id {
         chain chain_id {              # declarative
             type nat hook input priority 0; policy drop;
             ip daddr 192.168.1.100 dnat to 192.168.1.200;
         };
     };

Fails with:


     add-chain.tp.nft:6:9-38: Error: Chain of type "nat" is not 
supported, perhaps kernel support is missing?
             type nat hook input priority 0; policy drop;
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^


BUT, remove the 'add chain' lines, and `nft -c` exit code becomes a 0 
(success).

I see what I did wrong:

1. forgot to specify the correct chain type ... 2nd time (imperative), 
or define the correct chain type during the declarative stage
2. type/hook must align between 'add chain' imperative and 'table-chain' 
declarative
3. drop the 'add chain'

but the error message mmmm could be a bit more concise.

But I am not expecting a fix there because I saw what I did wrong.  Just 
concerned for the next fellow who stumbled my way.


I have all the NAT kernel modules loaded (include nf_chain_nat/nf_nat).

Running nftables v1.1.4 (tag, a83dab190a4cc6d770aa2b57079c78fd205a2abd), 
dated August 6, 2025.