1

This is my /etc/nftables.conf

#!/usr/sbin/nft -f
flush ruleset

define wan = { eth0 }


table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;

            # allow everything from loopback interface
            iif lo accept comment "Accept any localhost traffic"
            # drop invalid connection attempts
            ct state invalid drop comment "Drop all invalid connection attempts"
            # allow established and related connections
            ct state established,related accept comment "Accept all traffic initiated by us"
            # allow explicitly allowed services/ports/protocols
            iif $wan tcp dport 22 accept comment "wan"
            # Apply extra (manual configured) rules
            # reject everything that has  not been accepted before
            reject with icmpx type admin-prohibited comment "Drop everything, which is not explicitly allowed"
    }
    chain forward {
        type filter hook forward priority 0; policy drop;

            # allow everything from loopback interface
            iif lo accept comment "Accept any localhost traffic"
            # drop invalid connection attempts
            ct state invalid drop comment "Drop all invalid connection attempts"
            # Apply extra (manual configured) rules
            # reject everything that has  not been accepted before
            reject with icmpx type admin-prohibited comment "Drop everything, which is not explicitly allowed"
    }
    chain output {
        type filter hook output priority 0; policy accept;

            # Apply extra (manual configured) rules
            }
}

This is what I get from journalctl -u nftables.service, after running systemctl restart nftables.service:

Feb 01 18:54:40 mydomain.net systemd[1]: Starting nftables...
Feb 01 18:54:40 mydomain.net nft[1682]: /etc/nftables.conf:14:13-33: Error: Could not process rule: No such file or directory
Feb 01 18:54:40 mydomain.net nft[1682]:             ct state invalid drop comment "Drop all invalid connection attempts"
Feb 01 18:54:40 mydomain.net nft[1682]:             ^^^^^^^^^^^^^^^^^^^^^
Feb 01 18:54:40 mydomain.net nft[1682]: /etc/nftables.conf:16:13-47: Error: Could not process rule: No such file or directory
Feb 01 18:54:40 mydomain.net nft[1682]:             ct state established,related accept comment "Accept all traffic initiated by us"
Feb 01 18:54:40 mydomain.net nft[1682]:             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Feb 01 18:54:40 mydomain.net nft[1682]: /etc/nftables.conf:21:13-51: Error: Could not process rule: No such file or directory
Feb 01 18:54:40 mydomain.net nft[1682]:             reject with icmpx type admin-prohibited comment "Drop everything, which is not explicitly allowed"
Feb 01 18:54:40 mydomain.net nft[1682]:             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Feb 01 18:54:40 mydomain.net nft[1682]: /etc/nftables.conf:29:13-33: Error: Could not process rule: No such file or directory
Feb 01 18:54:40 mydomain.net nft[1682]:             ct state invalid drop comment "Drop all invalid connection attempts"
Feb 01 18:54:40 mydomain.net nft[1682]:             ^^^^^^^^^^^^^^^^^^^^^
Feb 01 18:54:40 mydomain.net nft[1682]: /etc/nftables.conf:32:13-51: Error: Could not process rule: No such file or directory
Feb 01 18:54:40 mydomain.net nft[1682]:             reject with icmpx type admin-prohibited comment "Drop everything, which is not explicitly allowed"
Feb 01 18:54:40 mydomain.net nft[1682]:             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Feb 01 18:54:40 mydomain.net systemd[1]: nftables.service: Main process exited, code=exited, status=1/FAILURE
Feb 01 18:54:40 mydomain.net systemd[1]: nftables.service: Failed with result 'exit-code'.
Feb 01 18:54:40 mydomain.net systemd[1]: Failed to start nftables.

When I comment the rules starting with "ct state" the service starts without an error. What is wrong here? The very same ruleset works fine on other machines.

System information:

OS: Debian 10

Kernel: 4.19.0-14-amd64

1 Answer 1

2

For anybody else encountering this problem. Make sure:

  1. The "netfilter" (and corresponding) kernel options are compiled either directly or as modules (grep -i netfilter /proc/config* or grep -i netfilter /boot/config*)
  2. If the option have been compiled as modules, make sure you do not have sysctl option kernel.modules_disabled set to 1. (edit /etc/sysctl.conf)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.