containers / containers/netavark

nftables meta mark for accepting forwarding packets

Open
#977 12 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
794
Forks
161
Avg merge
8d 17h
Merged PRs (30d)
3

Description

Hello,
I'm trying to build a linux based router that has podman for running basic containers. I'm running podman 5.0.1 with nftables support enabled in netavark for my testing. The issue I'm running into is I want to set my forward policy to drop. But this drops packets for podman.
Here is a basic firewall rule I'm trying to implement,
```
table inet filter {
chain forward {
type filter hook forward priority 0; policy drop;
iifname lan oifname wan accept;
}
}
```
With this configured, packets are not forwarded out of my containers.

I'm thinking that if we have netavark mark packets, then I can configure my rules to allow them easily.
For example,
```
table inet filter {
chain forward {
type filter hook forward priority 0; policy drop;
iifname lan oifname wan accept;
meta mark accept;
}
}
```

Is this something that we can do? Do you guys have any suggestions as to how I can handle this without needing to add this feature to netavark?

Thanks in advance!

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.