The iptables xt_bpf extension can be used to access auxiliary packet data, such as payload length. The xt_u32 extension can do it to some extent as well. I know that nftables supports a length meta selector, but the raw payload expression only supports fixed offsets or the base of layer 2, 3, or 4 headers. Is there any way to perform a match at a variable offset, for example to match SNI, using only nftables? As this is an embedded system with extremely limited resources, it isn't ideal to use both nftables and iptables simultaneously.

I would rather not use libnetfilter_queue or anything else which passes the decision making to userland, if possible. The filtering should occur entirely within the kernel.

  • You can use iptables, which has such feature, along nftables lacking the feature, and have them communicate using a mark. See When and how to use chain priorities in nftables, How --set-mark option works on Netfilter (IPTABLES)? and as an example of such cooperation nftables whitelisting docker.
    – A.B
    Oct 20, 2022 at 19:00
  • @A.B I'd rather keep the entirety of iptables out of the kernel.
    – forest
    Sep 1, 2023 at 1:35
  • That means you'd rather not have the feature...
    – A.B
    Sep 1, 2023 at 1:36
  • @A.B If there's no way at all to do this without libnetfilter_queue or creating my own module, then please write that as an answer and I'll accept it.
    – forest
    Sep 1, 2023 at 1:38
  • It's too difficult to say "no" for sure as an answer. That's why I was talking about alternatives. Are you in a constrained (embedded) environment to not even want some kernel modules and create your own instead?
    – A.B
    Sep 1, 2023 at 1:41


You must log in to answer this question.

Browse other questions tagged .