Is it still unimplemented?
Yes, but still only for a few weeks (Linux kernel 6.4 should be released at end of 2023-06 or start of 2023-07) . The accepted proposition (after a few iterations) for using broute with nftables in netfilter-devel is from 2023-02-24.
UPDATE: it's now officially implemented for nft
(nftables) >= 1.0.8 and even ebtables-nft
>= 1.8.10, see the update at the end of this answer.
It has been added in yet-to-be-released Linux kernel 6.4 on 2023-04-26:
Netfilter:
- Add nf_tables 'brouting' support, to force a packet to be routed
instead of being bridged
and is in the pipeline for the yet-to-be-released next nftables version, probably 1.0.8:
meta: introduce meta broute support
Can be used in bridge prerouting hook to divert a packet to the ip
stack for routing.
This is a replacement for ebtables -t broute
functionality.
There's no ebtables peculiarity about using accept/drop with a special broute type. It's used by setting the broute flag in a rule in the bridge family type filter and prerouting hook:
meta broute set 1
So instead of (using ebtables-legacy
, since ebtables-nft
has been lacking support for broute until recently):
ebtables-legacy -t broute -A BROUTING -p ! ipv6 -j DROP -i wan
one will do instead something like:
table bridge b {
chain prerouting {
type filter hook prerouting priority -250; policy accept;
ether type != ip6 iifname wan meta broute set 1 accept
}
}
In addition, ebtables-nft
(shipped through iptables
sources for the nftables backend variant), has also received an equivalent patch for the yet-to-be-released next version:
ebtables-nft: add broute table emulation
Use new meta broute set 1
to emulate -t broute
. If -t broute
is
given, automatically translate -j DROP
to meta broute set 1 accept
internally.
which will allow to use ebtables-nft
instead of ebtables-legacy
(still with kernel >= 6.4) to accept as-is:
ebtables -t broute -A BROUTING -p ! ipv6 -j DROP -i wan
UPDATE
as written above, kernel 6.4 released around 2023-06-25 received the feature
as written above, nftables 1.0.8 released around 2023-07-14 now supports broute:
iptables: 1.8.10 released around 2023-10-10 (also providing the binary ebtables) now supports broute with ebtables-nft
:
- Broute table support in ebtables-nft
From this version on, the command below will succeed:
ebtables-nft -t broute -A BROUTING -p ! ipv6 -j DROP -i wan
As written above DROP
is actually representing broute set 1 accept
as displayed back below (displaying is usually ok, altering is usually not ok):
# nft list ruleset
table bridge broute {
chain BROUTING {
type filter hook prerouting priority -2147483648; policy accept;
iifname "wan" ether type != ip6 counter packets 0 bytes 0 meta broute set 1 accept
}
}
(priority -2147483648 might look weird, but that's the same hook priority used by ebtables-legacy
: NF_BR_PRI_FIRST
)