Ok, c'est bien ce que j'avais compris.
Si ca peut aider, j'ai créé un service systemd (je suis sous archlinux, mais ca doit le faire sur les autres distribs utilisant systemd-network).
C'est juste pour injecter les bonnes rules à la création de l'interface et que le DHCP Client (systemd-network aussi), passe.
Je n'ai pas encore tester mais ca devrait fonctionner. Attention, il faut bien sûr conserver les rules netdev dans les règles firewall...
/etc/systemd/system/netdev-egress@.service
[Unit]
Description=netdev-egress pre-requisite for %i
After=network.target network-online.target
Wants=network-online.target
[Service]
Type=oneshot
ExecStartPre=/usr/lib/systemd/systemd-networkd-wait-online --interface=%i --operational-state=off --timeout=8
ExecStart=/etc/systemd/scripts/netdev-egress %i
RemainAfterExit=yes
TimeoutSec=10
/etc/systemd/scripts/netdev-egress :
#!/bin/sh
# apply netdev/egress priority for orange dhcp client requests
# Version 20240717
SleepRetry=3
# set orange interface
if [ -z "$1" ] ; then
iface="orange1"
else
iface="$1"
fi
echo "executing nft chain netdev filter egress device $iface"
ip link show dev $iface
if [ $? -ne 0 ] ; then
echo "ERROR : interface $iface not exist, retrying in ${SleepRetry}s..."
sleep $SleepRetry
ip link show dev $iface ; [ $? -ne 0 ] && echo "ERROR : interface $iface definitely not exist !" && exit 9
fi
echo "executing nft chain netdev filter egress device $iface"
echo ; echo "existing table netdev filter"
nft list table netdev filter
echo ; echo "applying nft chain netdev filter egress $iface"
nft add "table netdev filter"
nft add "chain netdev filter egress { type filter hook egress devices = { ${iface} } priority 0; }"
nft insert "rule netdev filter egress udp dport 67 meta priority set 0:6 ip dscp set cs6 counter comment \"egress_prio_${iface}_DHCP4\""
nft insert "rule netdev filter egress ether type arp meta priority set 0:6 counter comment \"egress_prio_${iface}_ARP\""
nft insert "rule netdev filter egress udp dport 547 meta priority set 0:6 ip6 dscp set cs6 counter comment \"egress_prio_${iface}_DHCP6\""
nft insert "rule netdev filter egress icmpv6 type { nd-router-solicit, nd-neighbor-solicit, nd-neighbor-advert } meta priority set 0:6 ip6 dscp set cs6 counter comment \"egress_prio_${iface}_ICMP6\""
#nft insert "rule netdev filter egress icmpv6 daddr { fe00::/7 } meta priority set 0:6 ip6 dscp set cs6 counter comment \"egress_prio_${iface}_ICMP6\""
echo ; echo "final nft table netdev filter"
nft list table netdev filter
echo ; echo "networkctl renew $iface"
networkctl renew $iface
echo ; echo "networkctl status $iface"
networkctl -s status $iface