使用Nftables放行DNS流量失败的问题求助

各位大佬好！我折腾了半天配置nftables规则，可DNS流量还是没法正常走，麻烦帮忙看看哪里出错了？我执行的命令如下：

nft add table inet tarffic
nft add chain inet traffic INPUT '{ type filter hook input priority 100; policy drop; }'
nft add rule inet traffic INPUT ip protocol icmp accept
nft add rule inet traffic INPUT ct state established,related accept
nft add rule inet traffic INPUT udp dport 53 accept
nft add rule inet traffic INPUT tcp dport 53 accept
nft add chain inet traffic OUTPUT '{ type filter hook output priority 100; policy drop; }'
nft add rule inet traffic OUTPUT ip protocol icmp accept
nft add rule inet traffic OUTPUT ct state established,related accept
nft add rule inet traffic OUTPUT udp dport 53 accept
nft add rule inet traffic OUTPUT tcp dport 53 accept

问题排查与修复方案 #

一眼就揪出了致命问题——你创建表的时候拼写错了！写的是tarffic（多了个r），但后面创建链、加规则时用的是正确的traffic，这就导致所有链和规则根本没加到你想要的表里，规则等于白配！

修复步骤很简单：

1. 先删掉那个错误的表（如果已经创建了）：

   nft delete table inet tarffic
   

2. 重新创建拼写正确的表，再执行后面的链和规则命令：

   nft add table inet traffic
   # 后面的命令保持原样执行就行
   nft add chain inet traffic INPUT '{ type filter hook input priority 100; policy drop; }'
   nft add rule inet traffic INPUT ip protocol icmp accept
   nft add rule inet traffic INPUT ct state established,related accept
   nft add rule inet traffic INPUT udp dport 53 accept
   nft add rule inet traffic INPUT tcp dport 53 accept
   nft add chain inet traffic OUTPUT '{ type filter hook output priority 100; policy drop; }'
   nft add rule inet traffic OUTPUT ip protocol icmp accept
   nft add rule inet traffic OUTPUT ct state established,related accept
   nft add rule inet traffic OUTPUT udp dport 53 accept
   nft add rule inet traffic OUTPUT tcp dport 53 accept
   

另外补个小建议：如果你的环境支持IPv6，当前规则只放行了IPv4的ICMP，最好再加上IPv6的ICMPv6放行规则，不然可能影响IPv6 DNS服务器的交互，命令如下：

nft add rule inet traffic INPUT ip6 protocol icmpv6 accept
nft add rule inet traffic OUTPUT ip6 protocol icmpv6 accept

调整完这些，DNS流量应该就能正常跑起来啦！

备注：内容来源于stack exchange，提问作者1ID