nftables 防火墙问题，请大佬指教！

这是目前设定的规则

table inet filter { chain input { type filter hook input priority filter; policy drop; ct state established,related counter accept ct state invalid counter packets drop ip protocol icmp accept icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, echo-request, mld-listener-query, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } accept iifname "lo" counter packets 0 bytes 0 accept tcp dport xxx counter accept meta nftrace set 1 } chain ips { type filter hook input priority filter - 2; policy accept; ip saddr 1.1.1.1 counter accept } } 

这是 tracing 调试日志（ drop 日志）

trace id ab8ac050 inet filter ips packet: iif "eth0" ether saddr 00:2a:6a:a4:0c:c1 ether daddr 00:16:3e:73:d4:5a ip saddr 1.1.1.1 ip daddr 2.2.2.2 ip dscp 0x01 ip ecn not-ect ip ttl 113 ip id 4681 ip protocol tcp ip length 52 tcp sport 10551 tcp dport 23237 tcp flags == syn tcp window 64240 trace id ab8ac050 inet filter ips rule meta nftrace set 1 (verdict continue) trace id ab8ac050 inet filter ips verdict continue trace id ab8ac050 inet filter ips policy accept trace id ab8ac050 inet filter input packet: iif "eth0" ether saddr 00:2a:6a:a4:0c:c1 ether daddr 00:16:3e:73:d4:5a ip saddr 1.1.1.1 ip daddr 2.2.2.2 ip dscp 0x01 ip ecn not-ect ip ttl 113 ip id 4681 ip protocol tcp ip length 52 tcp sport 10551 tcp dport 23237 tcp flags == syn tcp window 64240 trace id ab8ac050 inet filter input rule meta nftrace set 1 (verdict continue) trace id ab8ac050 inet filter input verdict continue trace id ab8ac050 inet filter input policy drop 

这是 tracing 调试日志（ accept 日志）

trace id b1cb1361 inet filter ips packet: iif "eth0" ether saddr 00:2a:6a:a4:0c:c1 ether daddr 00:16:3e:73:d4:5a ip saddr 3.3.3.3 ip daddr 2.2.2.2 ip dscp 0x01 ip ecn not-ect ip ttl 113 ip id 19123 ip protocol tcp ip length 64 tcp sport 6678 tcp dport 23237 tcp flags == 0x18 tcp window 1026 trace id b1cb1361 inet filter ips rule meta nftrace set 1 (verdict continue) trace id b1cb1361 inet filter ips verdict continue trace id b1cb1361 inet filter ips policy accept trace id b1cb1361 inet filter input packet: iif "eth0" ether saddr 00:2a:6a:a4:0c:c1 ether daddr 00:16:3e:73:d4:5a ip saddr 3.3.3.3 ip daddr 2.2.2.2 ip dscp 0x01 ip ecn not-ect ip ttl 113 ip id 19123 ip protocol tcp ip length 64 tcp sport 6678 tcp dport 23237 tcp flags == 0x18 tcp window 1026 trace id b1cb1361 inet filter input rule ct state established,related counter packets 1262 bytes 160127 accept (verdict accept) 

描述：3.3.3.3 已经通过 ssh 登录到 2.2.2.2 服务器，accept 日志最后检查 tcp 状态通过了防火墙 我的问题是：ips chain 里面的 IP 无法通过防火墙，请大佬指点！