# nftables with vlans rules fails during boot (solved)

## Tender

I would like to use nftables instead of iptables/ip6tables

But /etc/init.d/nftables during boot, "before net", fails in setting vlan rules because the vlan interfaces do not yet exist, the error is like this:

```
nft add rule ip FILTER INPUT ip saddr 10.10.10.10 iif enp0s29f7u4.514 drop

<cmdline>:1:51-65: Error: Interface does not exist

add rule ip FILTER INPUT ip saddr 10.10.10.10 iif enp0s29f7u4.514 drop

                                                  ^^^^^^^^^^^^^^^
```

Obviously this doesn't happen with iptables/ip6tables.

Where am I doing wrong?Last edited by Tender on Fri Mar 25, 2016 10:11 am; edited 2 times in total

----------

## Tender

Software involved:

```
Linux lowpower4 4.1.15-gentoo-r1 #1 SMP Sat Jan 23 09:42:19 CET 2016 x86_64 Intel(R) Atom(TM) CPU D525 @ 1.80GHz GenuineIntel GNU/Linux

[I] net-firewall/nftables

     Available versions:  (~)0.5-r2 {debug gmp +readline}

     Installed versions:  0.5-r2(09:37:40 AM 11/04/2015)(gmp readline -debug)

     Homepage:            http://netfilter.org/projects/nftables/

     Description:         Linux kernel (3.13+) firewall, NAT and packet mangling tools
```

----------

## Tender

I help myself : using iifname/oifname instead of iif/oif as clearly explained here https://home.regit.org/netfilter-en/nftables-quick-howto/:

 *Quote:*   

> Filter on interface
> 
> To accept all packets going out on loopback interface:
> 
> nft insert rule filter output oif lo accept
> ...

 

I think it's worth explaining this circumstance on the gentoo's wiki site integrating the document https://wiki.gentoo.org/wiki/Nftable

----------

