[BUG] "ether type ip" forgotten/implied when listing rules for 'netdev' family
Michal Soltys <[email protected]> Mon, 23 Feb 2026 15:57:28 +0100
| Newsgroups | gmane.comp.security.firewalls.netfilter.general |
|---|---|
| Message-ID | <[email protected]> |
Hi,
While testing the behavior of early filtering in netdev / ingress, I
noticed something that possibly looks like a bug.
Consider following and interface with one vlan, e.g.
ip add add 10.0.0.1/24 dev eno1
ip li add li eno1 name v250 type vlan id 250
ip add add 10.10.10.1/24 dev v250
ip li set eno1 up
ip li set v250 up
Now consider following simple nft setup:
nft add table netdev efil
nft add chain netdev efil edev { hook ingress type filter device eno1
priority filter; }
nft add rule netdev efil edev ether type ip icmp type echo-request counter
nft add rule netdev efil edev ether type vlan icmp type echo-request counter
nft add rule netdev efil edev icmp type echo-request counter
These will be listed by nft ruleset list as such:
table netdev efil {
chain edev {
type filter hook ingress device "eno1" priority filter;
policy accept;
icmp type echo-request counter packets 0 bytes 0
ether type 8021q icmp type echo-request counter packets
0 bytes 0
icmp type echo-request counter packets 0 bytes 0
}
}
Note that the first rule omits the "ether type ip" as if it was 'ip'
family instead of 'netdev'. So the 1st and the 3rd are listed the same -
but they work differently.
The first rule will only count plain ip payload, the 2nd rule will count
only vlan payload, the 3rd will count both. So after 1 ping to
10.10.10.1 and 1 ping to 10.0.0.1, the effect would be:
table netdev efil {
chain edev {
type filter hook ingress device "eno1" priority filter;
policy accept;
icmp type echo-request counter packets 1 bytes 84
ether type 8021q icmp type echo-request counter packets
1 bytes 84
icmp type echo-request counter packets 2 bytes 168
}
}
Furthermore it seems it's impossible to return to such ruleset via:
- nft list ruleset >rules
- flush tables
- nft -f rules
As this time the 1st and the 3rd rule actually will be identical both
visually and functionally, omitting 'ether type ip' check completely.