Package: nftables Version: 0.7-1 Severity: normal Dear Maintainer,
I have written a nftables script, which extensively uses Sets¹. Unexpected: It does block an IPv6-network, which is part of the set. The network has been loaded into the "named set". I checked it with: $ sudo nft list ruleset So, I cannot connect to the host by doing "ssh -6" for example. The DENY is visible in dmesg. The same script works as expected on a different host with Debian/Buster. As you can see below, I installed a backports kernel on this Debian/Stretch host. With the backports kernel the nftables script also works as expected. I can also make it work by removing some networks from the "named set". The named set currently contains ~2050 networks. I can attach the script later. It is long but not very complex. I personally can stick with the backports kernel or I can move to buster/sid as well. But maybe, this information is useful to somebody else? Kind regards, Aiko ¹: https://wiki.nftables.org/wiki-nftables/index.php/Sets -- System Information: Debian Release: 9.6 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 4.18.0-0.bpo.1-amd64 (SMP w/8 CPU cores) Locale: LANG=en_US, LC_CTYPE=en_US.utf8 (charmap=UTF-8) (ignored: LC_ALL set to en_US.utf8), LANGUAGE=en_US:en (charmap=UTF-8) (ignored: LC_ALL set to en_US.utf8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages nftables depends on: ii dpkg 1.18.25 ii init-system-helpers 1.48 ii libc6 2.24-11+deb9u3 ii libgmp10 2:6.1.2+dfsg-1 ii libmnl0 1.0.4-2 ii libnftnl4 1.0.7-1 ii libreadline7 7.0-3 ii libxtables12 1.6.0+snapshot20161117-6 nftables recommends no packages. nftables suggests no packages. -- no debconf information
