linux: fix nftables syntax (use 'ip protocol udp drop')

ammario · ammario · commit 77f6caa20c8c · 2025-09-10T12:09:45.000-05:00
diff --git a/src/jail/linux/nftables.rs b/src/jail/linux/nftables.rs
@@ -161,7 +161,7 @@ table ip {} {{
         tcp dport 53 accept
 
         # Explicitly block all other UDP (e.g., QUIC on 443)
-        udp drop
+        ip protocol udp drop
 
         # Allow traffic to the host proxy ports after DNAT
         ip daddr {} tcp dport {{ {}, {} }} accept
