TProxy nftables rule clarification

[unidcml]

The documentation suggests using the nftables rule

socket transparent 0 counter return

It looks like this rule is preventing new connections from being established to TProxy. I suggest using this rule instead

ct state != new socket transparent 0 counter return

[haruue]

Thank you for the suggestion!

Would you please create a Pull Request for it?

You can find the source of the TPROXY docs here.

[unidcml]

According to iptables-extensions man page the rule

iptables -t mangle -A HYSTERIA -m socket -j RETURN

ignores wildcard-bound sockets.

So the correct alternative for nftables is

socket transparent 0 socket wildcard 0 counter return

In my case this solved all connection problems.