IPv6环境下nftables配置导致无法连接DHCP服务器的排查请求

我的nftables配置如下：

table inet firewall {
    chain input {
        type filter hook input priority filter; policy drop;
        ct state invalid counter packets 0 bytes 0 drop comment "early drop of invalid packets"
        ct state established,related accept comment "accept all connections related to connections made by us"
        ct helper "ftp" accept
        iifname "lo" counter packets 63 bytes 3760 accept comment "accept loopback"
        iifname "lo" ip saddr != 127.0.0.0/8 drop
        iifname "lo" ip6 saddr != ::1 drop
        ip protocol icmp counter packets 0 bytes 0 accept comment "accept all ICMP types"
        meta l4proto ipv6-icmp accept comment "Accept ICMPv6"
        jump input-inetd
        jump output-inetd
        }
        
        chain forward {
            type filter hook forward priority filter; policy drop;
            ct state established,related,new accept
            iifname "br0" counter packets 250 bytes 22684 accept comment "forwarding only on bridge"
        }
    
        chain output {
            type filter hook output priority filter; policy accept;
            oifname "lo" counter packets 63 bytes 3760 accept comment "accept loopback"
            oifname "lo" ip daddr != 127.0.0.0/8 drop
            oifname "lo" ip6 daddr != ::1 drop
        }
    
        chain input-inetd {
            tcp dport 21 accept
            tcp dport 23 accept
        }
    
        chain output-inetd {
            tcp dport 20 accept
        }
    }

常规运行正常，但执行dhclient -6时仅输出以下内容，始终收不到Advertise消息（无RCV日志）：

XMT: Forming Rebind, 606790 ms elapsed.
XMT:  X-- IA_NA 1e:dd:f2:18
XMT:  | X-- Requested renew  +3600
XMT:  | X-- Requested rebind +5400
XMT:  | | X-- IAADDR 2a00:6020:500b:ef00:f6e1:1eff:fedd:f218
XMT:  | | | X-- Preferred lifetime +7200
XMT:  | | | X-- Max lifetime +7500
XMT:  V IA_NA appended.
XMT: Rebind on br0, interval 585450ms.

关闭nftables后，设备能正常和Fritz box交互，请问我的nftables配置哪里有问题？

核心问题 #

DHCPv6的Advertise消息是服务器（Fritz box）向客户端发送的新入站UDP流量，你的input链默认策略为drop，但当前规则未允许这类流量通过。

具体问题点：

1. 缺少DHCPv6入站流量规则：DHCPv6客户端监听UDP 546端口，服务器通过UDP 547端口发送Advertise消息，这类流量属于ct state new，当前input链仅允许established,related状态的流量，未放开DHCPv6相关的UDP端口。
2. 无效的规则跳转：input链里的jump output-inetd完全无效——output-inetd是为output链设计的规则链，放到input链中不会产生任何作用，应该删除。

修改方案 #

在input链的meta l4proto ipv6-icmp accept规则之后，添加允许DHCPv6客户端入站流量的规则：

udp dport 546 accept comment "Allow DHCPv6 client incoming traffic"

同时删除input链中的jump output-inetd这一行。

修改后的input链关键部分如下：

chain input {
    type filter hook input priority filter; policy drop;
    ct state invalid counter packets 0 bytes 0 drop comment "early drop of invalid packets"
    ct state established,related accept comment "accept all connections related to connections made by us"
    ct helper "ftp" accept
    iifname "lo" counter packets 63 bytes 3760 accept comment "accept loopback"
    iifname "lo" ip saddr != 127.0.0.0/8 drop
    iifname "lo" ip6 saddr != ::1 drop
    ip protocol icmp counter packets 0 bytes 0 accept comment "accept all ICMP types"
    meta l4proto ipv6-icmp accept comment "Accept ICMPv6"
    udp dport 546 accept comment "Allow DHCPv6 client incoming traffic"
    jump input-inetd
}

完成修改后重新加载nftables规则，再执行dhclient -6即可正常接收Advertise消息。

内容的提问来源于stack exchange，提问作者madam