[pkg-netfilter-team] Bug#914397: nftables: after Stretch->Buster upgrade, named set needs "auto-merge"

Gert t2 at gert.gr
Fri Nov 23 07:52:01 GMT 2018


After analyzing my config, I can now give a full example.
The subnet came from a geoblock list, the separate host came from an 
abusers list.
That causes the conflict in Buster (which can be fixed with auto-merge).
And I tried it again on a different Stretch machine, and it indeed works 
fine.
(Sorry, I could also have done all this for the first report, I now 
realize).

#!/usr/sbin/nft -f
table ip filter {
	set blacklist {
		type ipv4_addr
		flags interval
		elements = {
			192.0.2.0/24,
			192.0.2.1
		}
		# auto-merge # uncomment this to fix in Buster
	}
}



More information about the pkg-netfilter-team mailing list