On Fri, Dec 21, 2018 at 06:12:24PM +0800, wenxu@xxxxxxxxx wrote: [...] > +static struct xt_match tunnel_mt_reg __read_mostly = { > + .name = "tunnel", > + .revision = 0, > + .family = NFPROTO_UNSPEC, > + .match = tunnel_mt, > + .matchsize = sizeof(struct xt_tunnel_mtinfo), Does this work away from the prerouting hook? > + .me = THIS_MODULE, > +}; > + > +static int __init tunnel_mt_init(void) > +{ > + int ret; > + > + ret = xt_register_match(&tunnel_mt_reg); > + if (ret < 0) > + return ret; Probably one single line for this?