Requirements for nft nat pre/postrouting chains?

Hi,

I was reported that on our custom kernel some script didn't work with iptables-nft (default in debian for a while), and after investigating it looks like the nat rules for postrouting and prerouting are just not considered.

I've boiled down the reproducer to this:

---
nft add table ip test
nft chain ip test test '{ type nat hook prerouting priority -100; policy accept; }' nft add rule ip test test log prefix "test-pre-" counter packets 0 bytes 0

# at this point do some network activity;
# since there is no match specified new connections should trigger
# the log and increment counters for the rule
nft list table test

# (and cleanup)
nft delete table test
---

But while this works on my laptop, I can't get this to work in a minimal kernel, the rule stays stuck at zero:
---

table ip test {
        chain test {
                type nat hook prerouting priority dstnat; policy accept;
                log prefix "test-pre-" counter packets 0 bytes 0
        }
}

---

I've made everything a module and aligned loaded modules from standard debian to that VM to no avail, also tried naming the table 'nat' and chain 'PREROUTING' in case names are special (which would surprise me but you never know) with no difference either...

(I've also seen on the internet that for older kernels iptable_nat is incompatible with nft nat chains and tried taking it out, but that shouldn't be relevant anymore)

I'm starting to think it's just some silly setting somewhere and the way I'm testing it is wrong, but I'm out of ideas.

Am I missing something obvious?

Thanks!

Dominique Martinet

Dominique MARTINET wrote on Wed, Jul 27, 2022 at 05:03:32PM +0900:

Florian Westphal replied off list (thanks!)

After a couple of mails the problem just boils down to conntrack not being loaded by a log rule.
Adding a ct state rule in filter or any masquerade/redirect/snat/dnat in here enables it and everything works well.

I was just double-confused because my initial test machine, which had dnat rules was down to the other problem of older kernels:

So all is cleared up now,
thanks!

Dominique