An nftables flowtable — a connection-offload fast path that shortcuts the netfilter hooks for established flows.

A flowtable is attached to a base chain (forward hook, family-dependent) and lists devices on which to offload. Once a flow is in the table, subsequent packets bypass the rest of netfilter — software offload by default; hardware offload with :hw_offload flag if the NIC supports it.

Fields

• :name — flowtable name (unique within the table).
• :table — owning table's name.
• :hook — kernel-side, flowtables can only attach to the forward / ingress hooks; Linx stores whatever you set.
• :priority — integer or named atom; same shape as Chain's priority.
• :devices — list of interface name strings.
• :flags — list. :hw_offload is the common one.
• :handle — kernel-assigned handle; nil until pushed.

Construction

iex> Flowtable.new("ft1", hook: :ingress, priority: 0,
...>                devices: ["eth0", "eth1"])
{:ok, %Linx.Netfilter.Flowtable{name: "ft1", ...}}

Errors: {:error, {:bad_flowtable, reason}}.

References

• Documentation/networking/nf_flowtable