[PATCH 0/1] nwfilter: add default accept to nftables subchains

27 Oct 2026

      This patch aims to let the nwfilter nftables driver follow the nwfilter ebtables driver

In ebtables a subchain was created with a default accept

When converted to nftables, this resulted in an "accept" at the
end of each subchain:

chain O-v100562794-mac {
      ether daddr 52:54:00:a3:13:87 counter packets 9 bytes 1145 return
      ether daddr 33:33:00:00:00:00/16 counter packets 48 bytes 3712 return
      ether daddr ff:ff:ff:ff:ff:ff counter packets 22 bytes 924 return
      counter packets 3 bytes 384 drop
...
...
...
...
counter packets 0 bytes 0 accept
}
In order to mimick this behavior we add an "accept" for each subchain by
calling nftablesCreateSubChainAccept after having created all of the fw rules.

Dion Bosschieter (1):
  nwfilter: add default accept to nftables subchains

 src/nwfilter/nwfilter_nftables_driver.c       | 60 +++++++++++++++++--
 .../stp-linux.nftables.args                   | 14 +++++
 2 files changed, 69 insertions(+), 5 deletions(-)

-- 
2.53.0