containers / containers/netavark
nftables meta mark for accepting forwarding packets
- Dominant language
- Rust
- Stars
- 794
- Forks
- 161
- Avg merge
- 8d 17h
- Merged PRs (30d)
- 3
Description
Hello,
I'm trying to build a linux based router that has podman for running basic containers. I'm running podman 5.0.1 with nftables support enabled in netavark for my testing. The issue I'm running into is I want to set my forward policy to drop. But this drops packets for podman.
Here is a basic firewall rule I'm trying to implement,
```
table inet filter {
chain forward {
type filter hook forward priority 0; policy drop;
iifname lan oifname wan accept;
}
}
```
With this configured, packets are not forwarded out of my containers.
I'm thinking that if we have netavark mark packets, then I can configure my rules to allow them easily.
For example,
```
table inet filter {
chain forward {
type filter hook forward priority 0; policy drop;
iifname lan oifname wan accept;
meta mark accept;
}
}
```
Is this something that we can do? Do you guys have any suggestions as to how I can handle this without needing to add this feature to netavark?
Thanks in advance!
Contributor guide
Assessment
This issue has not been assessed yet.