Compile conntrack rules into raw-priority chains

2026-10-03 22:54:34 +10:00
parent 63c46fec81
commit c9adff32f6
4 changed files with 41 additions and 8 deletions
@@ -216,12 +216,12 @@ func (c *Compiler) compileConntrack(state *FirewallState) error {
 	for i, ct := range c.cfg.Conntrack {
 		tag := fmt.Sprintf("conntrack:%d", i)

-		chains := []string{"prerouting"}
+		chains := []string{"raw_prerouting"}
 		switch ct.Chain {
 		case config.ConntrackOutput:
-			chains = []string{"output"}
+			chains = []string{"raw_output"}
 		case config.ConntrackBoth:
-			chains = []string{"prerouting", "output"}
+			chains = []string{"raw_prerouting", "raw_output"}
 		}

 		matches, err := l4Matches(ct.Proto, ct.DPort, nil)