The rules below are working fine until trying to map ips/ports and I cannot comprehend how/why this is bound to happen... nft add rule nat prerouting dnat tcp dport map { 61023:179.x.x.x, 61023:172.25.120.2 } Error: Could not process rule: Device or resource busy add rule nat prerouting dnat tcp dport map { 61023:179.x.x.x, 61023:172.25.120.2 } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ _________________________________ table ip nat { chain prerouting { type nat hook prerouting priority 0; policy accept; } chain postrouting { type nat hook postrouting priority 100; policy accept; oif "ens3" masquerade } } table ip raw { chain prerouting { type filter hook prerouting priority -300; policy accept; } chain postrouting { type filter hook postrouting priority 100; policy accept; } } table inet filter { set tuc { type inet_proto flags constant elements = { tcp, udp } } set dd { type inet_proto flags constant elements = { 53, 67 } } set icmp_he { type inet_proto flags constant elements = { egp, 13, 15, udp } } chain input { type filter hook input priority 0; policy drop; ct state established,related accept tcp dport 56009 accept udp dport 61023 accept icmp type { echo-request, timestamp-request, info-request, address-mask-request } drop iif "lo" accept iifname "br*" tcp dport domain accept iifname "br*" udp dport domain accept iifname "br*" tcp dport bootps accept iifname "br*" udp dport bootps accept } chain forward { type filter hook forward priority 0; policy drop; oifname "br*" accept iifname "br*" accept } chain output { type filter hook output priority 0; policy accept; } } table netdev filter { chain nic { type filter hook ingress device ens3 priority 0; policy accept; meter global-meter { ip saddr limit rate 50/second burst 25 packets} continue tcp dport 56009 meter ssh-meter { ip saddr limit rate 10/minute burst 3 packets} accept udp dport 61023 meter ovpn-meter { ip saddr limit rate 10/hour burst 7 packets} accept } } table bridge filter { chain input { type filter hook input priority -200; policy accept; } chain forward { type filter hook forward priority -200; policy accept; } chain output { type filter hook output priority -200; policy accept; } } -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html