Re: No meta ibrindex/obrindex, only meta ibrname/obrname

Hi,

On Wed, 17 Jun 2026, at 2:34 AM, Corwyn Briggs wrote:
> Hello!
> I am somewhat new to Linux and am configuring a custom firewall for the 
> first time. I have come across a discrepancy wherein the index of an 
> interface on a bridge (i.e. a veth bonded to the bridge) cannot be used 
> to match in an inet chain, but the name can be used via meta 
> ibrname/obrname. I would like to use the index since it is a bit faster 
> and my interfaces should not be dynamic, but meta ibrindex/obrindex does 
> not exist in any manpages I have read. I checked over the archive as 
> best I could and did not see any discussion about the feature either. Is 
> this an intentional difference or rather just something which was never 
> implemented?

Support for meta ibriport/obriport was introduced by nft v0.3, then changed to meta ibrname/obrname by nft v0.8.4. But these are only usable within bridge family tables. For the inet family, one would use iifname/oifname instead.

One cannot compare against the bridge index; nftables simply doesn't support this at the current time. However, the difference between comparing an index and a name is that the former compares 4 bytes, while the latter compares (up to) 16 bytes. The chances are that you would be wholly unable to measure any difference in practice.

-- 
Kerin Millar