1

I am testing NFtables and am attempting to set up a basic routing firewall on a linux machine with 2 interfaces, ens37 and ens38. Here is the ifconfig output for these 2 interfaces.

ens37: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.0.3  netmask 255.255.255.0  broadcast 192.168.0.255
        ether 00:0c:29:74:33:e7  txqueuelen 1000  (Ethernet)
        RX packets 20  bytes 2524 (2.4 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 156  bytes 9952 (9.7 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

ens38: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.0.4  netmask 255.255.255.0  broadcast 192.168.0.255
        ether 00:0c:29:74:33:f1  txqueuelen 1000  (Ethernet)
        RX packets 147  bytes 9340 (9.1 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 18  bytes 1672 (1.6 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

I am wanting to emulate ens38 being a WAN port, and block all non-lan-initiated traffic that is inbound, but allow LAN traffic outbound.

I have these rules set up in /etc/nftables.conf :

#!/usr/sbin/nft -f

flush ruleset

table ip filter {
    # allow all packets sent by the firewall machine itself
    chain output {
        type filter hook output priority 100; policy accept;
    }

    # allow LAN to firewall, disallow WAN to firewall
    chain input {
        type filter hook input priority 0; policy accept;
        iifname "ens37" accept
        iifname "ens38" drop
    }

    # allow packets from LAN to WAN, and WAN to LAN if LAN initiated the connection
    chain forward {
        type filter hook forward priority 0; policy drop;
        iifname "ens37" oifname "ens38" accept
        iifname "ens38" oifname "ens37" ct state related,established accept
    }
}

To test if the rules are successful, I am setting up a listener with netcat:

nc -lp 80 -s 192.168.0.3

Then I connect from the other interface using netcat:

nc 192.168.0.3 80 -s 192.168.0.4

My issue is that these nftables rules are not blocking traffic from the emulated WAN port. The netcat connections work perfectly fine bidirectionally, which is not what I am looking for.

If I run nft list table filter, I get the rules I am expecting to see as output.

I am new to nftables, how can I get these rules to run against these two interfaces correctly? What is wrong with my current approach?

Improve this question
0

1 Answer 1

Reset to default
0

First I'd test from another host rather than the same machine, you generallty need to make special configurations to properly classify 'same host' traffic as 'input'.

Also, it seems odd that your WAN and LAN are on the same network range, there is of course no definition of normal in IP networks, but you are using 'related' and 'established' which are typically part of NAT.

Improve this answer
2
  • Its a virtual machine, I simply set those 2 interfaces that way for testing purposes
    – another_stack_user999
    Commented Oct 30, 2019 at 16:04
  • Please change the subnets, even for testing machine, packets needs to know which gateway they should use. Set network A as 192.168.1.0/24 and B 192.168.10.0/24. Ruleset seems okay, just use iif instead iifname. iifname is more for virtual interfaces, tun,ppp, etc which may not be available all the time, and it is slightly slower to match it like this.
    – fugitive
    Commented Oct 31, 2019 at 15:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .