Failed to match traffic with manually patched kernel v6.6.37

[pratikg-infinity]

Failed to match traffic with manually patched kernel v6.6.37

[vel21ripn]

conntrack -L is empty?
grep . /sys/module/xt_ndpi/parameters/err_ct* have non-zero values?

[pratikg-infinity]

conntrack -L is empty, err_ct_null has non-zero value and other params have 0 values.

$ conntrack -L

conntrack v1.4.7 (conntrack-tools): 0 flow entries have been shown.

$ sudo grep . /sys/module/xt_ndpi/parameters/err_ct*

/sys/module/xt_ndpi/parameters/err_ct_confirm:0
/sys/module/xt_ndpi/parameters/err_ct_free_magic:0
/sys/module/xt_ndpi/parameters/err_ct_ndpi:0
/sys/module/xt_ndpi/parameters/err_ct_nolabel:0
/sys/module/xt_ndpi/parameters/err_ct_null:282

[vel21ripn]

Need nf_conntrack running. I don’t know how to do this in “vyos 1.5” kernel “6.6.37-amd64-vyos”.
You may need to add some rule that checks the connection state (iptables -A FORWARD -m conntrack --ctstate INVALID -j DROP)

What does the command lsmod | grep conntrack show?

[pratikg-infinity]

Here is the output of lsmod-

$ lsmod | grep conntrack
nf_conntrack_netlink 61440 0
nf_conntrack 192512 5 nf_nat,nfnetlink_cthelper,nft_ct,nf_conntrack_netlink,xt_ndpi
nf_defrag_ipv6 24576 1 nf_conntrack
nf_defrag_ipv4 12288 1 nf_conntrack
nfnetlink 20480 4 nfnetlink_cthelper,nft_compat,nf_conntrack_netlink,nf_tables

[vel21ripn]

If "conntrack -L" does not show any connections, nDPI will not work.

[pratikg-infinity]

@vel21ripn Thanks for guidance. It was helpful. I figured out that, conntrack was not showing connections because NAT configuration was missing. After configuring SNAT rule as following, it started blocking connections.

set nat source rule 100 outbound-interface name 'eth0'
set nat source rule 100 translation address 'masquerade'