nftables: Create LED rules

Question

A have a weird scenario in which I need to create some firewall-rules to flash a LED. So far, I've always been able to do that using iptables:

iptables -A INPUT -p tcp --dport 443 -j LED --led-trigger-id mytrigger

So far, so good. There is a new issue, however: For various reasons, I now need to create such a rule not in the input-, but rather in an ingress-chain, which I can (AFAIK) only create and manage using nftables. However, I cannot for the life of me figure out how to create LED-rules using nft.

I have taken a look at the output of the rule created by iptables using nft list chain filter INPUT, which yields:

table ip filter {
    chain INPUT {
        type filter hook input priority filter; policy accept;
        tcp dport 443 counter packets 0 bytes 0 # led-trigger-id:"myfirewalltrigger"
    }
}

This is not helpful. Let's try iptables-translate -A INPUT -p tcp --dport 443 -j LED --led-trigger-id myfirewalltrigger:

nft # -A INPUT -p tcp --dport 443 -j LED --led-trigger-id myfirewalltrigger

This is not helpful either.

How come that nftables seemingly just cannot deal with LED rules?

Answer 1

I think you are having this problem because LED is an unsupported extension of iptables that is not now supported in nftables.

https://wiki.nftables.org/wiki-nftables/index.php/Supported_features_compared_to_xtables#LED

That is too bad because it sounds like you are doing something cool. Please revisit this question if you find a workaround (like parsing live logs and triggering on that?)