https://sindro.me/tags/nftables/ Recent content in Nftables on Marcello Barnaba Hugo en-us Fri, 01 May 2026 00:00:00 +0000 https://sindro.me/posts/2026-05-01-mwan3-failover-conntrack/ Fri, 01 May 2026 00:00:00 +0000 https://sindro.me/posts/2026-05-01-mwan3-failover-conntrack/ <p><strong>TL;DR:</strong> <a href="https://openwrt.org/docs/guide-user/network/wan/multiwan/mwan3" target="_blank">mwan3</a> reroutes <em>new</em> flows when an uplink dies. Existing flows stay pinned to the dead path — conntrack remembers, the firewall flow offload keeps shovelling packets along it, and long-lived TCP sockets linger until their application notices and reconnects. The native <code>flush_conntrack</code> option is a global nuke. The fix is a fifteen-line <code>/etc/mwan3.user</code> that does a <em>selective</em> conntrack flush by mwan3 mark on <code>disconnected</code> events only.</p>