Re: No meta ibrindex/obrindex, only meta ibrname/obrname

On Wed, 17 Jun 2026, at 2:52 AM, Kerin Millar wrote:
> Hi,
>
> On Wed, 17 Jun 2026, at 2:34 AM, Corwyn Briggs wrote:
>> Hello!
>> I am somewhat new to Linux and am configuring a custom firewall for the 
>> first time. I have come across a discrepancy wherein the index of an 
>> interface on a bridge (i.e. a veth bonded to the bridge) cannot be used 
>> to match in an inet chain, but the name can be used via meta 
>> ibrname/obrname. I would like to use the index since it is a bit faster 
>> and my interfaces should not be dynamic, but meta ibrindex/obrindex does 
>> not exist in any manpages I have read. I checked over the archive as 
>> best I could and did not see any discussion about the feature either. Is 
>> this an intentional difference or rather just something which was never 
>> implemented?
>
> Support for meta ibriport/obriport was introduced by nft v0.3, then 
> changed to meta ibrname/obrname by nft v0.8.4. But these are only 
> usable within bridge family tables. For the inet family, one would use 
> iifname/oifname instead.
>
> One cannot compare against the bridge index; nftables simply doesn't 
> support this at the current time.

I may have overstated this. Where iifname/oifname works in an inet table, so should iif and oif. But there is definitely no such analogue for meta ibrname/obrname (which pertains to the bridge family).

-- 
Kerin Millar