The netfilter NAT core cannot deal with both nftables and ip(6)tables nat at the same time. When both are active, one of the two will not work, depending on the order in which the modules were loaded. NAT hooks install a NAT null binding in case the iptables/nftables nat chain did not specify a nat mapping. Null bindings are needed to detect port collsisions between NAT-ed and non-NAT-ed connections. This causes nftables NAT rules to not work when iptable_nat module is loaded, and vice versa because nat binding has already been attached when the second nat hook is consulted. The alternative is to allow both at the same time. This requirs new internal nat hooks to do the null binding, but doesn't handle the more fundamental issue of precedence. Example: iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE nft add rule ip nat postrouting oifname ppp0 ip protocol udp dport 53 snat to 10.1.1.1 should nft override iptables? What if one is restored before the other (this seems to be the worst part as it could cause random behaviour with parallel init schemes ...) So, better explicitly disallow this for now. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
