Re: [PATCHv4 RESEND net-next 1/2] selftests: wireguards: convert iptables to nft
From: Jason A. Donenfeld
Date: Wed Mar 19 2025 - 12:10:48 EST
On Mon, Jan 06, 2025 at 08:10:42AM +0000, Hangbin Liu wrote:
> +n0 nft add rule ip wgtest INPUT meta length 1360 counter drop
What's the point of `counter` here? It's never read back.
> +n0 nft add rule ip wgtest POSTROUTING ip saddr 192.168.1.0/24 ip daddr 10.0.0.0/24 counter snat to 10.0.0.1
Ditto.
> +n1 nft add rule ip wgtest OUTPUT counter meta mark set 0x1
Ditto.
> +n2 nft add rule ip wgtest POSTROUTING ip saddr 10.0.0.0/24 ip daddr 192.168.241.0/24 counter snat to 192.168.241.2
Ditto.
> +n0 nft add rule ip wgtest INPUT iifname "vethrs" ip saddr != 10.0.0.0/24 counter drop
Ditto.