Why libnetfilter_queue(nfqnl_test) drop all the packets?

Hello, I followed this tutorials Queueing to userspace, on vyos1.4, but found libnetfilter_queue(nfqnl_test) drop all the packets.

Here are my situation:

  1. Runing vyos on x86 router. it works fine before I do the following steps. Computers connect to router can access internet.

  2. I run “./nfqnl_test 0” on the vyos. I did not change any code of nfqnl_test.

  3. I set some rules to nft like this:

nft 'add chain ip filter xxx { type filter hook prerouting priority security; policy accept; }'
nft add ip filter janus counter queue num 0 bypass
  1. I can see nfqnl_test receives a lot of packets and set ‘NF_ACCEPT’ to every packet.

  2. However, Computers connect to vyos can’t access internet.

  3. I run tcpdump on vyos, found like this (Only tcp syn packets found. The libnetfilter_queue(nfqnl_test) drop all the packets?):

I have tried prerouting, forward, postrouting hook points.

  1. All tcp or udp new connections would be dropped
  2. old connections are ok
  3. icmp is ok

Can anyone help me?