Questions tagged [nftables]
nftables is the successor of iptables/ip6tables and available since Linux kernel version 3.13
0
votes
1answer
8 views
Can I match a set negatively in nftables?
Let's say I want to apply a rule to ip daddr { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 }, but I want to exclude two more specific IPv4 addresses from that. How do I do that?
I was hoping for some ...
1
vote
1answer
25 views
How do I create a named set of strings in nftables (for interface names)?
Using sets in nftables is really cool. I am currently using a lot of statements like these in my nftables.conf rulesets:
iifname {clients0, dockernet} oifname wan0 accept comment "Allow clients and ...
1
vote
1answer
70 views
How to prevent iptables and nftables rules from running simultaneously?
I'm trying to set up a firewall on my own desktop (currently I'm tinkering with a Fedora 29 virtual machine). I would like to have it on the "deny-everything-by-default" basis. Almost immediately I ...
0
votes
0answers
20 views
Keep conntrack state for current ssh connection on netfilter rule flush/reload
When i am reloading netfilter with a new ruleset that drops invalid packets
flush ruleset
...
ct state invalid counter log prefix "Drop input invalid " drop comment "drop invalid packets"
...
over ...
3
votes
1answer
96 views
ip6table-restore failed in Debian buster/sid
I have the below iptable rule in /etc/iptables/rule.V6 and /etc/iptables/rule.V4
-4 -A INPUT -p icmp -j ACCEPT
-6 -A INPUT -p ipv6-icmp -j ACCEPT
when I tried to restart the netfilter-persistent, it ...
0
votes
1answer
53 views
How can I configure bidirectional protocol-independent port forwarding?
I am attempting to solve the following problem:
I have a system which I will henceforth refer to as "Local" that hosts a service on port 80 and port 443, and depends on sending outgoing requests on ...
1
vote
1answer
143 views
Nftables rules dissapiered after reboot!
I tried this:
iptables -F
ip6tables -F
sudo nft list ruleset > /etc/nftables.conf
sudo service netfilter-persistent save
But after reboot when i run
nft list ruleset
i see nothing. I think ...
2
votes
0answers
67 views
How to get a PID/name/path of a process that sends a network packet?
We have an application that sends some data over the TCP/IP network. We don't know which process that would be, but we want to target it. All we know is the following nftables log:
kernel: * OUTPUT * ...
4
votes
0answers
74 views
Multicast ICMPv6 comes back with conntrack state invalid
I was playing arround with the Multicast feature of IPv6.
$ ping ff02::2%wlp3s0
This should normally result in an echo-reply from all the routers on your local network segment (Wikipedia - IPv6).
So ...
0
votes
1answer
44 views
What do the letters 'BLA' refer to in `man nft`?
man nft has this section:
Do the letters B-L-A stand for something? (I've already ruled out Bla Bla.)
GNU/Linux Debian Stretch 9.6
6
votes
0answers
493 views
What is the difference between NFTables and BPFilter? [closed]
I trying to secure my home network with OpenWRT routers. In this context I started to customize my iptables rules to my needs and found some iptables concepts hard to understand.
I've discovered ...
2
votes
2answers
239 views
nftables / iptables rules to rewrite source IP by interface
I have a physical network with a Linux server (Ubuntu 16.04, kernel 4.13) and several gadgets on it. Each gadget has the same unchangeable static IP, e.g. 192.168.0.222/24. I would like to ...
1
vote
1answer
342 views
Is it possible to filter/drop packets by MAC using nftables
I have two systems that are connected over Ethernet and one system has a WiFi radio which provides internet access.
In this diagram sys#2 has the WiFi radio
sys#1 <---> Ethernet <---> ...
1
vote
1answer
548 views
How to match both UDP and TCP for given ports in one line with nftables
How can i do this in a single line?
tcp dport 53 counter accept comment "accept DNS"
udp dport 53 counter accept comment "accept DNS"
0
votes
0answers
129 views
How to use wildcard in a list with nftables
I'd like to use wildcards in a list with nftables. I tried this, but it gives me an error when I'm loading it:
iifname {"virbr*", "vboxnet*"} accept
oifname {"virbr*", "vboxnet*"} ct state ...
0
votes
1answer
343 views
nftables, add output rule syntax
I'm a bit frustrated by the lack of comprehensive documentation of nftables and currently I'm failing to get even a simple example to work. I'm trying just create a output rule. Here's my only table:
...
0
votes
1answer
731 views
When and how to use chain priorities in nftables
When configuring a chain in nftables, one has to provide a priority value. Almost all online examples set a piority of 0; sometimes, a value of 100 gets used with certain hooks (output, postrouting).
...
0
votes
1answer
71 views
How should I deal with cyclic dependencies caused by a systemd dynamic user not existing before the service starts?
I would like for dnscrypt-proxy to run as a dynamic user instead of as root. But I would also like to use a firewall rule in nftables where I specify the user dnscrypt-proxy, to allow it to connect to ...
2
votes
0answers
481 views
Internet access in LXC container with nftables
I'm currently trying to give an LXC container internet access using nftables, but I don't seem to get it right whatsoever.
The setup is the following:
The host has a WAN interface (enp1s0) and a ...
1
vote
1answer
374 views
Nftables configuration error: conflicting protocols specified: inet-service v. icmp
I am trying to build a simple stateful firewall with nftables following the Arch Linux nftables guide. I posted this question on the Arch Linux forum and never received an answer.
After completing ...
1
vote
1answer
358 views
Logging SSH public key connection attempts with nftables [closed]
Question
What is the best way to set up logging SSH attempts with SSH public-key authentication and nftables? Also, what is the best way to test this?
I'd like to do this without installing a ...
1
vote
2answers
2k views
Using Linux as router with nftables - masquerade not forwarding reply back
I have a Linux machine which I'm using as a router. It has 5 network interfaces: three separate LANs which it routes between, and two WANs. At the moment I just have one WAN as the default route, and ...
0
votes
1answer
750 views
Set up nftables to only allow connections through a vpn and block all ipv6 traffic
I am trying to set up a nftables firewall on my archlinux distribution that only allows traffic through a vpn (and blocks all ipv6 traffic in order to prevent any ipv6 leaks)
I have been playing ...
4
votes
1answer
1k views
nftables ip set multiple tables
Use case: I have a home router using iptables today. I'm researching converting over to nftables, as it looks to be much more manageable for a lot of rules.
One thing I have setup today under ...
0
votes
2answers
3k views
How to do Masquerading with NFTables
How would I implement a masquerading rule like this iptables one in NFTables:
iptables -t nat -A POSTROUTING -s 10.5.6.0/24 -o eth0 -j MASQUERADE
I've looked for it, but couldn't find out how to set ...
