From b45c0d6a81852f196ba87593cd2c66caa97807f5 Mon Sep 17 00:00:00 2001 From: Paul Payne Date: Thu, 15 Oct 2026 07:23:48 +0000 Subject: [PATCH] fix: Set nftables input chain priority to -1 for CrowdSec compatibility CrowdSec's blacklist chain runs at priority 0. Our loopback accept rule needs to run first so local traffic isn't blocked. Also cleans up .bak files after successful SafeApply. --- internal/nftables/manager.go | 5 ++++- internal/nftables/manager_test.go | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/internal/nftables/manager.go b/internal/nftables/manager.go index 249eed4..9f78107 100644 --- a/internal/nftables/manager.go +++ b/internal/nftables/manager.go @@ -96,7 +96,8 @@ func (m *Manager) Generate(haproxyPorts []int, extraTCPPorts []int, extraUDPPort sb.WriteString(" }\n\n") sb.WriteString(" chain input {\n") - sb.WriteString(" type filter hook input priority filter; policy accept;\n\n") + sb.WriteString(" # Priority -1 so loopback accept runs before CrowdSec's blacklist chain (priority 0)\n") + sb.WriteString(" type filter hook input priority -1; policy accept;\n\n") sb.WriteString(" iif \"lo\" accept\n") sb.WriteString(" ct state { established, related } accept\n") @@ -180,6 +181,8 @@ func (m *Manager) SafeApply(content string) error { return fmt.Errorf("verification failed (rolled back): %w", err) } + os.Remove(m.rulesPath + ".bak") + return nil } diff --git a/internal/nftables/manager_test.go b/internal/nftables/manager_test.go index 00bab70..b2a9e4e 100644 --- a/internal/nftables/manager_test.go +++ b/internal/nftables/manager_test.go @@ -43,7 +43,7 @@ func TestGenerate_AlwaysIncludesStructure(t *testing.T) { "table inet wild-central", "set allowed_tcp_ports", "chain input", - "type filter hook input priority filter; policy accept;", + "type filter hook input priority -1; policy accept;", "iif \"lo\" accept", "ct state { established, related } accept", } {