-
Notifications
You must be signed in to change notification settings - Fork 45
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
NordVPN + NfTables = error #179
Comments
Hey, Could you add the verbose log please? It seems it might be creating the nft chain with a different name than |
|
Hmm which distro are you using? It might be an issue with the kernel flags - https://zigford.org/firewalld-kernel-requirements.html ? Can you try with iptables ? |
iptables gets stuck on the last log:
and then:
Distro info
|
Hmm can you try it with |
With NfTables:
With IpTables:
|
Any idea? @jamesmcm |
Can you test just nftables alone, like: sudo ip netns add testnetns2
sudo ip netns exec testnetns2 ip addr add ::1/8 dev lo
sudo ip netns exec testnetns2 ip link set lo up
sudo ip link add testnetns2_d type veth peer name testnetns2_s
sudo ip link set testnetns2_d up
sudo ip link set testnetns2_s netns testnetns2 up
sudo ip addr add 10.200.3.1/24 dev testnetns2_d
sudo ip netns exec testnetns2 ip addr add 10.200.3.2/24 dev testnetns2_s
sudo ip netns exec testnetns2 ip route add default via 10.200.3.1 dev testnetns2_s
sudo ip netns exec testnetns2 ip -6 route add default via fe80::c418:42ff:fec9:62b6 dev testnetns2_s
sudo nft add table inet testnetns2_nat
sudo nft add chain inet testnetns2_nat postrouting { type nat hook postrouting priority 100 ; }
sudo nft add rule inet testnetns2_nat postrouting oifname enp3s0f3u1 ip saddr 10.200.3.0/24 counter masquerade
sudo nft add rule inet testnetns2_nat postrouting oifname enp3s0f3u1 ip6 saddr fe80::c418:42ff:fec9:62b6/24 counter masquerade
sudo nft add table inet testnetns2_bridge
sudo nft add chain inet testnetns2_bridge forward { type filter hook forward priority -10 ; }
sudo nft add rule inet testnetns2_bridge forward iifname testnetns2_d oifname enp3s0f3u1 counter accept
sudo nft add rule inet testnetns2_bridge forward oifname testnetns2_d iifname enp3s0f3u1 counter accept
sudo sysctl -q net.ipv4.ip_forward=1
sudo sysctl -w net.ipv6.conf.default.forwarding=1
sudo ip netns exec testnetns2 sysctl -w net.ipv6.conf.default.forwarding=1
sudo ip netns exec testnetns2 bash Then run: ping 8.8.8.8 Inside that test network namespace? |
Mmm... I got stuck at: |
Can you please check your version of nftables: $ nft --version
nftables v1.0.5 (Lester Gooch #4) And Linux kernel: $ uname -a
Linux vivobook 5.19.5-zen1-1-zen #1 ZEN SMP PREEMPT_DYNAMIC Mon, 29 Aug 2022 15:51:08 +0000 x86_64 GNU/Linux |
nftables v0.9.3 (Topsy) |
Try to update if you're able to, I think the issue is that that version lacks support for postrouting. |
My config:
I obviously have a NordVPN active account. I wonder if I missed something in configuration. I tried also iptables but it gets stuck on Launching OpenVPN...
The text was updated successfully, but these errors were encountered: