Hello MikroTik team and community,
First of all, thank you for the continuous improvements to the Container package. The inclusion of nft_tproxy, nf_tproxy_ipv4/v6, and nf_tables modules in recent 7.2x releases has been fantastic. We can now successfully implement manual TPROXY using the inet family (prerouting / output hooks) inside containers, which works perfectly.
However, I would like to request the enablement of the netdev address family and its ingress hook for container network namespaces.
The Issue:
Many modern networking applications and proxy cores (such as sing-box with its auto_redirect feature, or various eBPF/XDP-based traffic management tools) rely on the netdev family to perform extremely early traffic interception directly on the interface (e.g., eth0 or veth).
Currently, when these applications attempt to automate their transparent proxy rules inside a RouterOS container, they fail with the following netlink error:
Plaintext
netlink receive: operation not supported
Tracing the nft execution reveals that the exact unsupported operation is:
Bash
nft add chain netdev X { type filter hook ingress device eth0 priority 0; }
# Error: Chain of type "filter" is not supported
Why this matters:
While we can currently work around this by writing custom shell scripts to inject manual inet TPROXY rules before the app starts, lacking netdev ingress breaks the "out-of-the-box" automation (like auto_redirect: true) of modern network containers.
Since the container traffic is already isolated via the veth interface, would it be possible to expose/enable the netdev ingress filtering capabilities for container network namespaces in a future RouterOS 7 release?
Thank you for your time and consideration!