Rejections of related/established connections?

[Koen Drai]

Hi,

Not sure if I am missing something, but I keep running into connections being rejected
that should be accepted from how I (think I :)) have defined the rules.
I somehow get the feeling that the behavior below is related to nft rules only containing
"new, untracked" but not related and established.

Googled if there is a way to add these two states to rules, but did not find anything.
A direct rule might help, but since these are discouraged for futureproofness, trying to
figure out the "right" way.


Working on a Debian 11 system, nftables backend.


Example 1, syncthing:
zone file knet.xml, amongst others:

   <service name="syncthing"/>
   <source-port port="22000" protocol="tcp"/>
   <source-port port="22000" protocol="udp"/>
   <rule family="ipv4">
     <source address="192.168.1.1/24"/>
     <port port="22000" protocol="tcp"/>
     <accept/>
   </rule>
   <rule family="ipv4">
     <source address="192.168.1.1/24"/>
     <port port="22000" protocol="udp"/>
     <accept/>
   </rule>


Nicely translated into the nft ruleset (amongst others):

ip saddr 192.168.1.0/24 tcp dport 22000 ct state { new, untracked } accept
ip saddr 192.168.1.0/24 udp dport 22000 ct state { new, untracked } accept


However, I still get these errors in syslog:

filter_IN_knet_REJECT: "IN=enp2s0 OUT= MAC=<ANOM> SRC=192.168.1.54
DST=192.168.1.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=33526 DF PROTO=TCP SPT=22000 DPT=22000
WINDOW=65535 RES=0x00 SYN




Example 2, Apache as an https proxy:
  <rule family="ipv4">
     <source address="192.168.1.13"/>
     <source-port port="443" protocol="tcp"/>
     <accept/>
   </rule>


  ip saddr 192.168.1.13 tcp sport 443 ct state { new, untracked } accept


"filter_IN_knet_REJECT: "IN=enp2s0 OUT= MAC=<ANOM> SRC=192.168.1.13
DST=192.168.1.1 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=TCP SPT=443 DPT=34860
WINDOW=0 RES=0x00 RST URGP=0


What's going on here?


Thanks a lot for your help and best regards