Implicit add conflicts with declarative add
S Egbert <[email protected]> Wed, 20 Aug 2025 13:39:11 -0500
| Newsgroups | gmane.comp.security.firewalls.netfilter.general |
|---|---|
| Message-ID | <[email protected]> |
Take the following NFT snippet:
add table ip table_id # imperative
add chain ip table_id chain_id # imperative???
table ip table_id {
chain chain_id { # declarative
type nat hook input priority 0; policy drop;
ip daddr 192.168.1.100 dnat to 192.168.1.200;
};
};
Fails with:
add-chain.tp.nft:6:9-38: Error: Chain of type "nat" is not
supported, perhaps kernel support is missing?
type nat hook input priority 0; policy drop;
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
BUT, remove the 'add chain' lines, and `nft -c` exit code becomes a 0
(success).
I see what I did wrong:
1. forgot to specify the correct chain type ... 2nd time (imperative),
or define the correct chain type during the declarative stage
2. type/hook must align between 'add chain' imperative and 'table-chain'
declarative
3. drop the 'add chain'
but the error message mmmm could be a bit more concise.
But I am not expecting a fix there because I saw what I did wrong. Just
concerned for the next fellow who stumbled my way.
I have all the NAT kernel modules loaded (include nf_chain_nat/nf_nat).
Running nftables v1.1.4 (tag, a83dab190a4cc6d770aa2b57079c78fd205a2abd),
dated August 6, 2025.