Re: prefix len confusion

Try this:

table ip filter {
    chain forward {
        type filter hook forward priority filter;
        iifname "lo" accept # please filter this too, you'll bounce your bu=
shies (brows)
        iifname $IFACE goto wan-in
        ip protocol icmp accept
        # so is LAN
        ip saddr $INTv4 accept
        drop
    }
    chain wan-in {
        ip saddr $BOGONS4 drop
        ip daddr $VULN4 drop
        ip protocol icmp accept
        ip saddr $JUMP4 accept
        ip saddr $EXTv4 accept
        tcp dport 8006 ip daddr $PROX4 drop   # block proxmox web login
...

Basically, you want to drop anything you don't like before you accept anyth=
ing that you do (unless it will be dropped by a later hook). Someone mentio=
ned no input hook registration; that should be OK as docs say that later ho=
oks still get evaluated... test to be sure.

Refer to VERDICT STATEMENT in https://www.netfilter.org/projects/nftables/m=
anpage.html; it says '
accept - Terminate ruleset evaluation and accept the packet. The packet can=
 still be dropped later by another hook...'.

So currently, if iifname was lo (due to some other kernel vuln), or protoco=
l was ICMP, or saddr was jump4 or extv4: it will get forwarded to the machi=
ne within 42.642.11.80/30

Hope all is well,
sunny

CONFIDENTIALITY NOTICE:
This email and its attachments are intended solely for the use of the inten=
ded addressee; and may contain confidential and/or privileged information. =
You are hereby notified that any unauthorized use of this email or its atta=
chments is strictly prohibited. If you have received this email in error, p=
lease destroy instances of it, and any information that was derived directl=
y from it. To be clear, the message and its headers (SMTP, IMAP, POP messag=
e, etc.) is 'this email', but network headers (Ethernet, Internet Protocol,=
 Transmission Control Protocol, User Datagram Protocol, etc.) are not.

SIGNATURE NOTICE:
If we have not met, the below public key is not useful.

sunny_0x00000000_public.asc

-----BEGIN PGP PUBLIC KEY BLOCK-----
KEY REDACTED, WE HAVE NOT MET.
-----END PGP PUBLIC KEY BLOCK-----