nftables自定义链dyn规则不生效，优先级设置无效问题排查求助

大家好，我遇到了一个nftables的棘手问题，想请各位帮忙排查一下原因。

我现在配置了两条面向input钩子的链：一条是常规的input链，另一条是动态生成的dyn链。但不管怎么调整，dyn链里的规则就是不生效——我试过把input链的优先级设为1，dyn链设为0甚至-200，结果还是一样。只有当我清空input链的所有规则后，dyn链的规则才会正常工作。

我实在摸不着头脑，下面是我用sudo nft list ruleset导出的当前规则集：

table inet filter {

chain input {

type filter hook input priority filter + 1; policy accept;

iif "lo" accept

ct state established,related accept

tcp dport 299 ip saddr 3x.xx.xx.xx accept

icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, echo-request, echo-reply, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, 148, 149 } accept

ip6 saddr fe80::/10 icmpv6 type { mld-listener-query, mld-listener-report, mld-listener-done, mld2-listener-report, 151, 152, 153 } accept

counter packets 10 bytes 5255 drop

}

chain dyn {

type filter hook input priority filter; policy accept;

iif "lo" accept

ct state established,related accept

ip saddr 2x.xx.xx.xx udp dport 8999 log prefix "dyn" accept

ip6 saddr xxx:xxxx:xxxx:xxxx::9999 udp dport 8999 log prefix "dyn" accept

ip saddr 2x.xx.xx.xx tcp dport 7999 log prefix "dyn" accept

ip6 saddr xxx:xxxx:xxxx:xxxx::9999 tcp dport 7999 log prefix "dyn" accept

ip saddr 2x.xx.xx.xx icmp type echo-request log prefix "dyn" accept

ip6 saddr xxx:xxxx:xxxx:xxxx::9999 icmp type echo-request log prefix "dyn"

ip saddr 2x.xx.xx.xx tcp dport 6999 log prefix "dyn" accept

ip6 saddr xxx:xxxx:xxxx:xxxx::aaaa tcp dport 6999 log prefix "dyn" accept

}

}

有没有大佬能帮我分析下问题出在哪？万分感谢！

备注：内容来源于stack exchange，提问作者Nkk