From fca7ece7b2f1a0d35fbb49b100252cfc48cc110d Mon Sep 17 00:00:00 2001 From: Lenar Khannanov <55162739+comeillfoo@users.noreply.github.com> Date: Thu, 23 Apr 2026 01:46:59 +0500 Subject: [PATCH] fix(app): invalid priority in output hook when setting redirect with nft (#1551) * fix(app): invalid priority in output hook when setting redirect with nft Server startup fails with nftables before v1.0.9, as it doesn't support dstnat mnemonic in the output hook. Work around this by using the raw number (-100) as recommended by Florian Westphal [1]. 1. https://bugzilla.netfilter.org/show_bug.cgi?id=1694#c1 * chore(app): use "-100" instead of "dstnat" for both chains --------- Co-authored-by: Toby --- app/internal/firewall/firewall_linux.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/app/internal/firewall/firewall_linux.go b/app/internal/firewall/firewall_linux.go index e271eda..d841617 100644 --- a/app/internal/firewall/firewall_linux.go +++ b/app/internal/firewall/firewall_linux.go @@ -97,8 +97,8 @@ func setupNFTablesRedirect(r commandRunner, listenAddr *net.UDPAddr, ports, redi } cleanup.add(func() { _ = nft("delete", "table", family, tableName) }) for _, chainArgs := range [][]string{ - {"add", "chain", family, tableName, "prerouting", "{", "type", "nat", "hook", "prerouting", "priority", "dstnat;", "policy", "accept;", "}"}, - {"add", "chain", family, tableName, "output", "{", "type", "nat", "hook", "output", "priority", "dstnat;", "policy", "accept;", "}"}, + {"add", "chain", family, tableName, "prerouting", "{", "type", "nat", "hook", "prerouting", "priority", "-100;", "policy", "accept;", "}"}, + {"add", "chain", family, tableName, "output", "{", "type", "nat", "hook", "output", "priority", "-100;", "policy", "accept;", "}"}, } { if err := nft(chainArgs...); err != nil { _ = cleanup.Close()