3

I wanted to add the rule arp saddr ip 192.168.2.1 counter accept to my Nftables firewall. When reading the config-file with sudo nft -f /etc/nftables2.conf, I get the error-message

/etc/nftables2.conf:26:21-15: Error: syntax error, unexpected saddr 
                 arp saddr ip 192.168.2.1 counter accept
                                   ^^^^^^

Table in question:

table arp filter {
        chain input {
                type filter hook input priority 0; policy drop;
                arp saddr ip 192.168.2.1 counter accept
        }
        chain output {
                type filter hook input priority 0; policy accept;
        }
}

I can´t get it fixed. At first I tried different IPs, then I tried the same with saddr ether <MAC of device> instead of the IP address but got the same result. I use nftables version 0.9.0 on the newest Raspberry Pi OS. Can someone please point out where my mistake lies? I´m kinda lost.. Thanks for your time.

1
  • 1
    @A.B I used the nftables version 0.9.6 from buster-backports and everything worked perfectly. Sorry for my late reply. Aug 2, 2021 at 10:36

1 Answer 1

3

Your ruleset is correct. But your nftables version is slightly too old. Here's the announce including your example:

[ANNOUNCE] nftables 0.9.1 release:

Hi!

The Netfilter project proudly presents:

    nftables 0.9.1

This release contains fixes and new features, available up with Linux kernels >= 5.2.

[...]

  • ARP sender and target IPv4 address matching, eg.

      table arp x {
              chain y {
                      type filter hook input priority filter; policy accept;
                      arp saddr ip 192.168.2.1 counter packets 1 bytes 46
              }
      }
    

    this updates rule counters for ARP packets originated from the 192.168.2.1 address.

So you might need kernel >= 5.2 (that's unclear if required) but do need nftables >= 0.9.1

For the kernel: https://www.raspberrypi.org/software/operating-systems/ shows that Raspberry Pi OS currently comes with kernel 5.10.x so this is a moot point.

For the nftables version, while it's usually not recommended, you can try and use buster-backports to get a newer version of nftables, currently 0.9.6. If you find this is not suitable for RPi, you should instead recompile from (Debian) sources your own backported package.

Note: the wiki lags a bit and might not always be completely accurate. Usually the man page is more accurate, once the feature exists of course. Eg:

buster's version 0.9.0:

ARP HEADER EXPRESSION

arp [ARP header field]

versus buster-backports' version 0.9.6:

ARP HEADER EXPRESSION

arp {htype | ptype | hlen | plen | operation | saddr { ip | ether } | daddr { ip | ether }

Workaround for simple cases (and additional difficulty)

If you really can't change nftables for simple cases like this one, it's possible to use a raw payload expression instead, with good knowledge of the ARP protocol, keeping in mind that this protocol is intended to be used on more than just Ethernet and IPv4 and thus has a few generic parts that are always constants in usual IPv4 over Ethernet use (eg: hlen=6, plen=4).

Anyway I cheated and just read back a working ruleset with nftables 0.9.0 to get it displayed as raw payload, and translated the decimal output in hex (except payload offset and length):

table arp filter {
    chain input {
        type filter hook input priority 0; policy drop;
        @nh,112,32 0xc0a80201 counter accept
    }

    chain output {
        type filter hook input priority 0; policy accept;
    }
}

which is easy to read using Wikipedia's link:

  • offset 112 (in bits) is offset 14 in bytes: Sender Protocol Address aka saddr ip.

  • length 32 bits: An IPv4 address length

    0xc0a80201 means 192.168.2.1

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .