Reasoning behind in/out/fwd netfilter rules

[tomp (Thomas Parrott)]

See discussion here for more detail

Lxd bridge doesn't work with IPv4 and UFW with nftables

I recreated the issue. So on Groovy, installing ufw and using its default configuration will use the iptables shim to insert nftables rules. So LXD then uses nftables. Installing nftables package allows you see both the rules added by UFW and by LXD. However in its default configuration ufw drops all incoming traffic. Although LXD has added allow rules for DHCP and DNS, these are still blocked because, as per nftables documentation: Configuring chains - nftables wiki NOTE : If a packet i…

To actually drop traffic you can use our network acl feature.