Right, so it blocked the first part of the chain. Which normally uses unprivilgeed network namespace to dp net admin inside that. I had been thinking of a RxRP

Right, so it blocked the first part of the chain. Which normally uses unprivilgeed network namespace to dp net admin inside that. I had been thinking of a RxRPC AF block for the second part of the chain which seems rarer. Systemd seems to have this setting for units since 2011: > The setting RestrictAddressFamilies aims to restrict what socket address families can be used. When using it, the default is that it is used as an allow-list and define what address families can be used. > Example > A common combination might look like this. [Service] SystemCallArchitectures=native RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX