On Sun, Oct 18, 2026 at 03:45:57AM +0200, Pablo Neira Ayuso wrote: > I don't understand the "one flowtable per class".
If the priority is a flowtable attribute, every flow in that flowtable gets the same one. To give sip 1:3 and https 1:5, you need two flowtables with the same devices. nf_tables rejects a device in two flowtables of one table (nft_register_flowtable_net_hooks() returns -EEXIST), so you also need two tables. With the per-flow priority it is one flowtable and the rules that set the priority today: udp dport 5060 meta priority set 1:3 flow add @ft tcp dport 443 meta priority set 1:5 flow add @ft v4 waits until the fdb series is done. Julius
