vyos@vyos:~$ sudo nft list table inet vrf_zones table inet vrf_zones { map ct_iface_map { typeof iifname : ct zone elements = { "eth0" : 12817, "dum0" : 12817, "wg500" : 12817, "wg501" : 12817, "veth1" : 12817, "bond10.5" : 12817, "red" : 12817, "bond10.500" : 12817, "bond10.666" : 12817 } } chain vrf_zones_ct_in { type filter hook prerouting priority raw; policy accept; counter packets 1718123113 bytes 986223532227 ct original zone set iifname map @ct_iface_map counter packets 1718098550 bytes 986220580739 ct original zone set iifname map @ct_iface_map counter packets 1718095644 bytes 986220267697 ct original zone set iifname map @ct_iface_map } chain vrf_zones_ct_out { type filter hook output priority raw; policy accept; counter packets 179468909 bytes 41465072796 ct original zone set oifname map @ct_iface_map counter packets 179467883 bytes 41464947652 ct original zone set oifname map @ct_iface_map counter packets 179467781 bytes 41464933878 ct original zone set oifname map @ct_iface_map }
TODO
- Add smoketest validating that also on interface removal, it's no longer part of the ct_iface_map