"Let 192.0.2.20 in" is checked with two requests: from the one let in and from one who is not.
Access for one source is checked from both sides: the allowed 192.0.2.20 gets the page, while 192.0.2.30 still waits until the timeout. The requests are the same; only --interface changes.
Both got the page: the permission came out wider than the task, or the filter is gone altogether. Both wait: the new file is not loaded, the rule has the wrong port, or the permission comes after drop. Do not take the file's text on trust: the loaded ruleset decides, and nft list ruleset prints it.
Deleting the table or running nft flush ruleset also "opens .20", but it opens it to everyone else too.
You fixed the permission for 192.0.2.20 and loaded the file. Now both 192.0.2.20 and 192.0.2.30 get the page. What could have happened?
Several options are correct.
-
Then nothing would reach the permission:
counter dropwould drop both192.0.2.20and192.0.2.30. -
The old rules let
192.0.2.20reach8081only and dropped8080for everyone. With the old set both clients would wait until the timeout.
A page for 192.0.2.30 means the permission became wider or the block is gone. sudo ip netns exec lab-server nft list ruleset prints what is actually loaded.
Key points
- Access for one source is checked with two requests: the allowed one gets an answer, the others do not.
-
The loaded ruleset decides: after editing the file, load it and read
nft list ruleset.