On 5/13/20 10:02 PM, D&R wrote: > nftable.conf is setup as: > > flush ruleset > table inet nat { > chain postrouting { > type nat hook postrouting priority srcnat; policy accept; > masquerade random,persistent > } > } > table inet filter { > chain input { > type filter hook input priority filter; policy drop; > counter jump block > } > chain forward { > type filter hook forward priority filter; policy drop; > counter jump block > } > chain output { > type filter hook output priority filter; policy accept; > } > chain block { > ct state { established, related } counter accept comment > "accept all connections related to connections made by us" > iifname "enp1s0" counter accept > iifname "enp2s0" counter accept > iif "lo" accept comment "accept loopback" > tcp dport xxxxx counter accept comment "accept SSH" > counter log prefix "IPTABLES IN= " level crit flags tcp > sequence,options > counter drop comment "count dropped packets" > } > } > > > After it runs for a few minutes it adds the following at the bottom of the > table: > > > table ip filter { > chain INPUT { > type filter hook input priority filter; policy accept; > counter packets 214 bytes 18153 jump block > } > > chain FORWARD { > type filter hook forward priority filter; policy accept; > counter packets 525 bytes 85145 jump block > } > > chain OUTPUT { > type filter hook output priority filter; policy accept; > } > > chain block { > } > } > > I can't explain this, can anyone else do so? > > Thanks, > > David > _______________________________________________ > users mailing list -- users@lists.fedoraproject.org > To unsubscribe send an email to users-le...@lists.fedoraproject.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.org
maybe something else is running like firewalld? i've been using nftables for a while on other distros and now on fedora and i haven't seen any changes being made to my nftables.conf. maybe run "systemctl status firewalld"? _______________________________________________ users mailing list -- users@lists.fedoraproject.org To unsubscribe send an email to users-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.org