From 538aeeccc46d31ab54647b67c8a2ba442d61cc46 Mon Sep 17 00:00:00 2001
From: sarthurdev <965089+sarthurdev@users.noreply.github.com>
Date: Wed, 21 Feb 2024 16:03:07 +0100
Subject: conntrack: T5376: Fix priority for CT helpers

Ref: https://www.spinics.net/lists/netfilter/msg59549.html
---
 data/templates/conntrack/nftables-ct.j2 | 36 ++++++++++++++++++++++++---------
 1 file changed, 26 insertions(+), 10 deletions(-)

diff --git a/data/templates/conntrack/nftables-ct.j2 b/data/templates/conntrack/nftables-ct.j2
index 762a6f693..c753e6bcb 100644
--- a/data/templates/conntrack/nftables-ct.j2
+++ b/data/templates/conntrack/nftables-ct.j2
@@ -40,9 +40,6 @@ table ip vyos_conntrack {
 
     chain PREROUTING {
         type filter hook prerouting priority -300; policy accept;
-{% if ipv4_firewall_action == 'accept' or ipv4_nat_action == 'accept' %}
-        counter jump VYOS_CT_HELPER
-{% endif %}
         counter jump VYOS_CT_IGNORE
         counter jump VYOS_CT_TIMEOUT
         counter jump FW_CONNTRACK
@@ -51,11 +48,15 @@ table ip vyos_conntrack {
         notrack
     }
 
-    chain OUTPUT {
-        type filter hook output priority -300; policy accept;
 {% if ipv4_firewall_action == 'accept' or ipv4_nat_action == 'accept' %}
+    chain PREROUTING_HELPER {
+        type filter hook prerouting priority -5; policy accept;
         counter jump VYOS_CT_HELPER
+    }
 {% endif %}
+
+    chain OUTPUT {
+        type filter hook output priority -300; policy accept;
         counter jump VYOS_CT_IGNORE
         counter jump VYOS_CT_TIMEOUT
         counter jump FW_CONNTRACK
@@ -66,6 +67,13 @@ table ip vyos_conntrack {
         notrack
     }
 
+{% if ipv4_firewall_action == 'accept' or ipv4_nat_action == 'accept' %}
+    chain OUTPUT_HELPER {
+        type filter hook output priority -5; policy accept;
+        counter jump VYOS_CT_HELPER
+    }
+{% endif %}
+
 {{ helper_tmpl.conntrack_helpers(module_map, modules, ipv4=True) }}
 
     chain FW_CONNTRACK {
@@ -122,9 +130,6 @@ table ip6 vyos_conntrack {
 
     chain PREROUTING {
         type filter hook prerouting priority -300; policy accept;
-{% if ipv6_firewall_action == 'accept' or ipv6_nat_action == 'accept' %}
-        counter jump VYOS_CT_HELPER
-{% endif %}
         counter jump VYOS_CT_IGNORE
         counter jump VYOS_CT_TIMEOUT
         counter jump FW_CONNTRACK
@@ -132,11 +137,15 @@ table ip6 vyos_conntrack {
         notrack
     }
 
-    chain OUTPUT {
-        type filter hook output priority -300; policy accept;
 {% if ipv6_firewall_action == 'accept' or ipv6_nat_action == 'accept' %}
+    chain PREROUTING_HELPER {
+        type filter hook prerouting priority -5; policy accept;
         counter jump VYOS_CT_HELPER
+    }
 {% endif %}
+
+    chain OUTPUT {
+        type filter hook output priority -300; policy accept;
         counter jump VYOS_CT_IGNORE
         counter jump VYOS_CT_TIMEOUT
         counter jump FW_CONNTRACK
@@ -144,6 +153,13 @@ table ip6 vyos_conntrack {
         notrack
     }
 
+{% if ipv6_firewall_action == 'accept' or ipv6_nat_action == 'accept' %}
+    chain OUTPUT_HELPER {
+        type filter hook output priority -5; policy accept;
+        counter jump VYOS_CT_HELPER
+    }
+{% endif %}
+
 {{ helper_tmpl.conntrack_helpers(module_map, modules, ipv4=False) }}
 
     chain FW_CONNTRACK {
-- 
cgit v1.2.3