I did more tests. If I create any rule called conntrack (in input, forward, with different conditions), Conntrack affects all traffic that passes through or to the router.

I think this should be considered expected behaviour, during the several iterations of the firewall (including Vyatta era - without explicit tables and chains) we've not changed the logic of enabling conntrack.

The conntrack logic has always been to check if any firewall rule uses state matching, enable conntrack. If NAT is used, enable conntrack etc.

ref: https://github.com/vyos/vyos-1x/blob/current/src/conf_mode/system_conntrack.py#L196

@sarthurdev I think, conntract should be transferred from input or forward to the global section or used in prerouting. Because now it looks like conntrack is used only in these rules, not for all traffic.

@a.apostoliuk @sarthurdev I saw this a while back and was thinking about it today. I think it'd be useful to be able to disable conntrack per chain. It could be useful for people using VyOS in an ISP environment, where the firewall is more a mechanism to secure VyOS itself, rather than filter through traffic. It'd be pretty easy to implement.

@L0crian @a.apostoliuk @sarthurdev I think I agree with the idea to add an option to disable conntrack per chain. I made a task about that: T7475

I stumbled over it today on my 1.4 boxes. It would be nice to have the possibilty to exclude forwarding traffic from conntrack.

I would like to have conntrack only for local rules (INPUT/OUTPUT) but forward with notrack.

On the net I found:

nft add table ip stateless
nft add chain ip stateless prerouting '{ type filter hook prerouting priority -310; policy accept; }'
nft add rule ip stateless prerouting iif != lo fib daddr oif exists notrack

Replacing the ip family with the inet combo family should extend the same generic behavior to IPv4+IPv6.

And:

Note that for this statement to be effective, it has to be applied to packets before a conntrack lookup happens. Therefore, it needs to sit in a chain with either prerouting or output hook and a hook priority of -300 or less.