[SOLVED] error in nf tables when using ct state : Protocol wrong type for socket

Issue

I'm struggling to configure my nf tables rules on my distro. I'm using nft 1.0.4 and Linux 4.9.

When I am using the ct state instruction, nft throw the following error:

nftables.cfg:25:17-43: Error: Could not process rule: Protocol wrong type for socket
                ct state established accept
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^

My Kernel config contains the following parameters

# enable nftables support
CONFIG_NF_TABLES=y
CONFIG_NF_TABLES_INET=y # inet allows IPv4 and IPv6 config in single rule
CONFIG_NF_TABLES_NETDEV=y
CONFIG_NF_CONNTRACK=y # for NAT support
CONFIG_NF_NAT=y # for NAT support
CONFIG_NF_TABLES_SET=y # to use brackets (sets)

CONFIG_NFT_EXTHDR=y
CONFIG_NFT_META=y
CONFIG_NFT_CT=y
CONFIG_NFT_RBTREE=y
CONFIG_NFT_HASH=y
CONFIG_NFT_COUNTER=y
CONFIG_NFT_LOG=y
CONFIG_NFT_LIMIT=y
CONFIG_NFT_MASQ=y
CONFIG_NFT_REDIR=y
CONFIG_NFT_NAT=y
CONFIG_NFT_QUEUE=y
CONFIG_NFT_REJECT=y
CONFIG_NFT_REJECT_INET=y
CONFIG_NFT_COMPAT=y
CONFIG_NFT_CHAIN_ROUTE_IPV4=y
CONFIG_NFT_REJECT_IPV4=y
CONFIG_NFT_CHAIN_NAT_IPV4=y
CONFIG_NFT_MASQ_IPV4=y
# CONFIG_NFT_REDIR_IPV4 is not set
CONFIG_NFT_CHAIN_ROUTE_IPV6=y
CONFIG_NFT_REJECT_IPV6=y
CONFIG_NFT_CHAIN_NAT_IPV6=y
CONFIG_NFT_MASQ_IPV6=y
# CONFIG_NFT_REDIR_IPV6 is not set
CONFIG_NFT_BRIDGE_META=y
CONFIG_NFT_BRIDGE_REJECT=y

my ruleset is something like

#!/sbin/nft -f

flush ruleset

table inet myfilter {
        chain myinput {
                type filter hook input priority 0; policy drop;
                ct state established,related accept
                tcp dport ssh accept
                tcp dport 53 accept
                udp dport 53 accept
                ip protocol icmp accept
                iif "lo" accept
                tcp dport 2181 accept
                tcp dport 9092 accept

        }

        chain myoutput {
                type filter hook output priority 0; policy drop;
                ct state established accept
                tcp dport ssh accept
                tcp dport 53 accept
                udp dport 53 accept
                udp dport snmp accept
                tcp dport http accept
                tcp dport https accept
                ip protocol icmp accept
        }

        chain forward {
                type filter hook forward priority 0; policy drop;
        }
}

Do you have any idea how to fix this?

Solution

Actually the error come from the version of the kernel I am using: 4.9. nftables needs at least v4.10 to fully support ct states as stated in debian documentation here https://packages.debian.org/stretch/nftables

A Linux kernel >= 3.13 is required. However, >= 4.10 is recommended.

Answered By - Perceval

Answer Checked By - Marilyn (WPSolving Volunteer)