System conntrack ignore does not take any effect.
vyos@r14# run show conf com | match conntrack set system conntrack ignore rule 10 destination address '0.0.0.0/0' [edit] vyos@r14# sudo conntrack -C 3 [edit] vyos@r14# curl vyos.io [edit] vyos@r14# [edit] vyos@r14# sudo conntrack -C 5 [edit] vyos@r14#
Priority must be less than -200 https://github.com/vyos/vyos-1x/blob/08cb4f350b335d5af401f30850d410b4be38530d/data/vyos-firewall-init.conf#L23-L32
https://wiki.nftables.org/wiki-nftables/index.php/Setting_packet_connection_tracking_metainformation#notrack_-_Bypass_connection_tracking
chain PREROUTING {
type filter hook prerouting priority -200; policy accept;
counter packets 6405 bytes 444828 jump VYOS_CT_IGNORE
counter packets 6405 bytes 444828 jump VYOS_CT_TIMEOUT
counter packets 6405 bytes 444828 jump VYOS_CT_PREROUTING_HOOK
counter packets 6405 bytes 444828 jump FW_CONNTRACK
notrack
}
chain OUTPUT {
type filter hook output priority -200; policy accept;
counter packets 4990 bytes 537336 jump VYOS_CT_IGNORE
counter packets 4990 bytes 537336 jump VYOS_CT_TIMEOUT
counter packets 4990 bytes 537336 jump VYOS_CT_OUTPUT_HOOK
counter packets 4990 bytes 537336 jump FW_CONNTRACK
notrack
}