Network ACLs on routed NICs?

beddari · September 16, 2026, 1:17pm

We use routed NICs for all instances (BGP to the host, per-instance /128 announced by the speaker). We’d like to put ACLs and address sets on them, but security.acls is only wired up for bridged and OVN NICs.

From what I can see in the code, bridged render ACL rules into a bridge-family nft chain:

github.com/lxc/incus

internal/server/device/nic_bridged.go

fb52ed4f8


      
          // setFilters sets up any network level filters defined for the instance.
          // These are controlled by the security.mac_filtering, security.ipv4_Filtering, security.ipv6_filtering and security.acls config keys.
          func (d *nicBridged) setFilters() (err error) {

Routed only set up the RP filter chain:

github.com/lxc/incus

internal/server/device/nic_routed.go

fb52ed4f8


      
          	// Apply firewall rules for reverse path filtering of IPv4 and IPv6.
          	err = d.state.Firewall.InstanceSetupRPFilter(d.inst.Project().Name, d.inst.Name(), d.name, saveData["host_name"])

The firewall interface only has the bridge variant:

github.com/lxc/incus

internal/server/firewall/firewall_interface.go

fb52ed4f8


      
          	InstanceSetupBridgeFilter(projectName string, instanceName string, deviceName string, parentName string, hostName string, hwAddr string, IPv4Nets []*net.IPNet, IPv6Nets []*net.IPNet, IPv4DNS []string, IPv6DNS []string, parentManaged bool, macFiltering bool, aclRules []drivers.ACLRule) error
          	InstanceClearBridgeFilter(projectName string, instanceName string, deviceName string, parentName string, hostName string, hwAddr string, IPv4Nets []*net.IPNet, IPv6Nets []*net.IPNet) error

The ACL-to-nft rule code and the address-set code looks to be generally valid, so an InstanceSetupRoutedFilter or similar seems like a worthwhile addition? Is there a reason it hasn’t been done, and would a feature request be welcome?