Niko/hysteria
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(app): invalid priority in output hook when setting redirect with nft (#1551)

Browse source 
* fix(app): invalid priority in output hook when setting redirect with nft

Server startup fails with nftables before v1.0.9, as it doesn't support
dstnat mnemonic in the output hook. Work around this by using the raw
number (-100) as recommended by Florian Westphal [1].

1. https://bugzilla.netfilter.org/show_bug.cgi?id=1694#c1

* chore(app): use "-100" instead of "dstnat" for both chains

---------

Co-authored-by: Toby <tobyxdd@gmail.com>
This commit is contained in:
Lenar Khannanov 2026-04-23 01:46:59 +05:00 • committed by GitHub
parent 6476d21c59
commit fca7ece7b2
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
app/internal/firewall/firewall_linux.go
View file

@ -97,8 +97,8 @@ func setupNFTablesRedirect(r commandRunner, listenAddr *net.UDPAddr, ports, redi
}
cleanup.add(func() { _ = nft("delete", "table", family, tableName) })
for _, chainArgs := range [][]string{
{"add", "chain", family, tableName, "prerouting", "{", "type", "nat", "hook", "prerouting", "priority", "dstnat;", "policy", "accept;", "}"},
{"add", "chain", family, tableName, "output", "{", "type", "nat", "hook", "output", "priority", "dstnat;", "policy", "accept;", "}"},
{"add", "chain", family, tableName, "prerouting", "{", "type", "nat", "hook", "prerouting", "priority", "-100;", "policy", "accept;", "}"},
{"add", "chain", family, tableName, "output", "{", "type", "nat", "hook", "output", "priority", "-100;", "policy", "accept;", "}"},
} {
if err := nft(chainArgs...); err != nil {
_ = cleanup.Close()