1

From the nftables Quick reference:

family refers to a one of the following table types: ip, arp, ip6, bridge, inet, netdev.

and

type refers to the kind of chain to be created. Possible types are:

filter: Supported by arp, bridge, ip, ip6 and inet table families.
route: Mark packets (like mangle for the output hook, for other hooks use the type filter instead), supported by ip and ip6.
nat: In order to perform Network Address Translation, supported by ip and ip6.

From another document which explains how to configure chains:

The possible chain types are:

filter, which is used to filter packets. This is supported by the arp, bridge, ip, ip6 and inet table families.

route, which is used to reroute packets if any relevant IP header field or the packet mark is modified. If you are familiar with iptables, this chain type provides equivalent semantics to the mangle table but only for the output hook (for other hooks use type filter instead). This is supported by the ip, ip6 and inet table families.

nat, which is used to perform Networking Address Translation (NAT). Only the first packet of a given flow hits this chain; subsequent packets bypass it. Therefore, never use this chain for filtering. The nat chain type is supported by the ip, ip6 and inet table families.

Hence, according to at least two authoritative references, no chain type is supported by the netdev family. Given that, how can we use the netdev family at all?

Improve this question

1 Answer 1

Reset to default
2

I am new one, but also interested in nftables rules. I found in nftables wiki: "The principal (only?) use for this (netdev) family is for base chains using the ingress hook, new in Linux kernel 4.2." More info here, in the end of article: https://wiki.nftables.org/wiki-nftables/index.php/Nftables_families

Ingress hook allows you to filter L2 traffic. It comes before prerouting, after the packet is passed up from the NIC driver. This means you can enforce very early filtering policies. This very early location in the packet path is ideal for dropping packets associated with DDoS attacks. When adding a chain on ingress hook, it is mandatory to specify the device where the chain will be attached

Source: https://www.datapacket.com/blog/securing-your-server-with-nftables

How to specify the device can be found here: How to use variable for device name when declaring a chain to use the (netdev) ingress hook?

Improve this answer
4
  • Please provide additional details in your answer. As it's currently written, it's hard to understand your solution.
    – Community Bot
    Commented Sep 4, 2021 at 23:08
  • Thanks for the answer, accepted and +1. Of course, I had already found that section of the manual. However, the information in the wiki is obviously wrong which was the reason for the question.
    – Binarus
    Commented Sep 6, 2021 at 7:37
  • Binarus, thank you! I just wanted to attrack attention to the question, it's very interesting for me. I didn't know that wiki is wrong. If someday you will have working example, especially in arp filtering in netdev I hope you will post it here.
    – Tina
    Commented Sep 6, 2021 at 21:15
  • There's a v5 candidate for an egress hook (which will be followed by a v6 anyway). So an egress hook might appear... hopefully in kernel 5.16 or 5.17. It would allow for example to firewall a DHCP client application which currently evades nftables with raw sockets.
    – A.B
    Commented Oct 1, 2021 at 13:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .