Questions tagged [nftables]
nftables is the successor of iptables/ip6tables and available since Linux kernel version 3.13
79
questions
0
votes
1answer
19 views
Get netfilter statistics on the command line
I am finally switching from the old iptables to the new netfilter (specifically using firewalld) to configure my computers and servers but so far I have failed to find any newer alternative to the ...
0
votes
0answers
17 views
wireguard multiple servers: IPv6 does not work
I'm tunneling the traffic to two different servers. But for IPv6 I can not reach the internet although I can ping my phone (VPN client) from the server via IPv6.
However I can not reach the web server ...
0
votes
1answer
80 views
nftables: ct state rule produces “Error: Could not process rule: No such file or directory”
This is my /etc/nftables.conf
#!/usr/sbin/nft -f
flush ruleset
define wan = { eth0 }
table inet filter {
chain input {
type filter hook input priority 0; policy drop;
# ...
1
vote
1answer
58 views
Nftables default drop chain problem
I'd like to take a default drop approach to my firewall rules. I've created some rules for testing purposes:
table bridge vmbrfilter {
chain forward {
type filter hook forward priority -...
0
votes
0answers
37 views
Nftables block ports
I have a captive portal (nodogsplash) on my access point (Raspberry Pi 3b+). I have some websites running on port 3000 and 5000. I am "blocking" them by the following command in "/etc/...
0
votes
0answers
26 views
TCPDump : ghost connection
here is the tcpdump capture.
10:57:41.678675 IP (tos 0x0, ttl 173, id 26512, offset 0, flags [none], proto TCP (6), length 40) 194.26.25.102.55243 > XXX.XXX.XXX.XXX.10000: Flags [S], cksum 0x4f11 (...
2
votes
0answers
44 views
Filter non-IP traffic on STA wlan0 interface
I want to filter inbound and outbound non-IP traffic going through the wlan0 interface of a Raspberry Pi 3B+ (connected via Wi-Fi to an AP).
iptables / ip6tables only seem to affect IP traffic, so ...
0
votes
1answer
31 views
Errors when defining nft rules in multple places
My nftable file was growing too big. I tried to split it into smaller files and use include, but I got errors. I probably do not understand how are multiple parts merged together.
nftables will read ...
0
votes
0answers
34 views
Using nftable to duplicate udp packet
I am trying to setup udp packet duplication. Usecase will be syslog messages. These messages are beeing sent to machine A ( xxx.xxx.xxx.177 : 5140 , debian 10). They are received by a service. With ...
1
vote
1answer
58 views
nftables destination nat block local access to port
I have set up nftables on my server and I want to redirect all traffic coming in to certain protected ports (e.g. 80) to be redirected to a higher port which is available without root permissions (e.g....
0
votes
1answer
34 views
Why does firewalld deny nft masquerade traffic from my LAN?
I'm trying to share wifi internet over an ethernet LAN. Two machines A and B, both running Fedora 32, are joined by an ethernet switch, and A is connected to the internet over wifi. In firewalld.conf:
...
1
vote
1answer
430 views
How to properly log and view nftables activity?
On Debian 10 buster I am having problems with docker containers unable to ping the docker host or even docker bridge interface, but able to reach the internet.
Allowing access as in related questions ...
1
vote
3answers
140 views
Nftables management problem
I've migrated from iptables to nftables and have one annoying problem. In the old system I had a script which removed/added a few rules each day. I was able to easily add/delete iptables rules by ...
0
votes
0answers
47 views
nftable performance - Dropping vs Blocking Port scanners
I need your opinion on a better strategy to defect port scanners.
Currently we are blocking all the port scan traffic by dynamically adding src address to a blocked IP set with timeout (using nftables)...
2
votes
1answer
84 views
using nft to count bytes on a dynamic set of saddr
I'm trying to work out if there is a simple way to use nft to dynamically build a list of saddr and count the packets/bytes on each of them. I don't want to apply any limits on traffic - just measure ...
4
votes
1answer
421 views
Packet processing order in nftables
I am moving from iptables to nftables. I have a basic questions about the packet processing order in nftables.
Since one can create multiple tables of same type, say inet, and also chains can be ...
0
votes
0answers
210 views
Using qemu/kvm with nftables? (without firewalld!)
With libvirt/qemu/kvm you can define a bridge (or more) to be used by the guest machines. The libvirt machinery should take care of the creation of the bridge - normally called virbr0 with virbr0-nic (...
2
votes
1answer
172 views
Is there a sort of wildcards in nftables?
In iptables it was possible to use eth+ as interface name to match any interface starting with eth (or as a more practical example this also worked to match virbr+ and veth+, i.e. the + seemed to have ...
1
vote
2answers
215 views
nftables: duplicate broadcast packets between segments
We have a Debian Buster box (nftables 0.9.0, kernel 4.19) attached to four different network segments. Three of these segments are home to devices running Syncthing, which runs its own local discovery ...
0
votes
0answers
45 views
How to set priority of network traffic for services using systemd?
I want to be able to specify the priority for all incoming and outgoing network traffic of a service in its systemd unit configuration to be able to ensure that some services get a higher priority for ...
1
vote
1answer
254 views
How do I replace nftables rules atomically?
I'm trying to atomically replace nftables rules. Nftables's official wiki states that -f is the recommended way to achive this. However, when I run nft -f /path/to/new/rules on Debian Buster, the new ...
2
votes
1answer
560 views
Can nftables and iptables/ip6tables rules be applied at the same time? If so: what's the order of precedence?
The question is pretty much already in the title:
Can nftables and iptables/ip6tables rules be applied at the same time? If so: what's the order of precedence?
The reason I ask is this: plenty of ...
-1
votes
1answer
55 views
Safe rule applying remotely using NFT
If you have experience, could you please advise, how to safely apply firewall rules remotely on Linux using NFT ?
Particularly on Debian, we used for a long time iptables-apply(8) to safely apply ...
0
votes
1answer
61 views
How can I restrict outbound connection to a single domain name?
I would like to restrict the outbound access of my device to a single domain name, let's say abc.com. How can I do that?
Device needs to resolve the domain name to an IP address which might change ...
1
vote
2answers
69 views
nftables preventing services from resolving on IPv6
I've got my server set up with long list of services, and everything is working great... on IPv4. But when I test them against IPv6 nothing is resolving. After disabling nftables everything started ...
1
vote
1answer
195 views
Compare bytes of `saddr` and `daddr` in NFTables
I have a lot of subnets 10.x.y.0/24, where 0 ā¤ x ā¤ 50 and 0 ā¤ y ā¤ 20.
I would like to allow traffic between 10.x.y.0/24 and 10.z.y.0/24 for every value of (x, y, z).
I could do a script using the ...
-1
votes
1answer
140 views
Updating a mutable named set in nftables with responses from bind
I need to apply an nftables rule to all traffic originating from a specific host, but the packets will not necessarily include the proper FQDN, so I need to rely on the IP address(s). The issue is ...
1
vote
1answer
681 views
Check whether iptables or nftables are in use
Given a host that is in an unknown state of configuration, I would like to know if there is an effective way of non-interactively determining if the firewall rule set in place is managed by iptables ...
1
vote
0answers
102 views
better nftable config for NAT of IPv4 over IPv6 by MAP-E (RFC 7597)
I am configuring nftable (/usr/sbin/nft) for IPv4 over IPv6 tunneling. There are several standards for tunneling IPv4 packets encapsulated in IPv6 packets. One of popular methods is MAP-E (RFC 7597). ...
0
votes
1answer
468 views
nftables dynamic blacklisting both IPv4 and IPv6
In setting up dynamic blacklists for nftables, per A.B.'s excellent answer, I'm encountering an error when duplicating the blacklist for both ipv4 and ipv6. I perform the following command-line ...
1
vote
1answer
379 views
nftables changes on reboot
This is my /etc/sysconfig/nftables.conf
#!/usr/sbin/nft -f
flush ruleset
table ip filter {
chain input {
type filter hook input priority filter; policy accept;
ct state ...
0
votes
0answers
47 views
How to scan another machine on the local network for open ports when most ports are closed in one's nftables firewall?
I have almost all ports blocked (outbound and inbound) in my nftables firewall in Debian10 - how can I still scan another machine on the same local network for open ports with nmap/zenmap?
How are ...
0
votes
0answers
51 views
How to write a nftables rule that can be enabled/disabled?
Basically I want to have rule(s) that I could switch on or off with a simple command.
I don't want to add the rule dynamically with nft add rule ... becasue the position is important and the required ...
0
votes
0answers
80 views
Why my system can only do port forwarding when I ssh to it?
I use debian 10 with kernel 4.19 and nftables as port forwarding tool. The rule is like
table ip nat {
chain prerouting {
type nat hook prerouting priority -100; policy accept;
ip ...
2
votes
1answer
2k views
Create dynamic blacklist with nftables
I want to create a dynamic blacklist with nftables. Under version 0.8.3 on the embedded device I create a ruleset looks like this with nft list ruleset:
table inet filter {
set blackhole {
type ...
1
vote
1answer
163 views
Simplify nftables (net filter tables) rules
I have a working nftables rule-set. However it is very long, and has a lot of repeated code:
Exact (just a few characters different) duplicate for ip4 and ip6.
Chains of rules, that branch into near ...
2
votes
1answer
358 views
Route traffic in a cgroup outside a VPN tunnel
I'm trying to get some traffic to go through a VPN and other traffic to not do so.
Packets with a given fwmark are supposed to go to my default interface (wlo1), and all other traffic to a tunnel ...
1
vote
1answer
274 views
How to make nftables duplicate multiple interfaces to one interface
My home router has 2 internal interfaces on different subnets, and one external interface plugged into the comcast modem. I'd like to duplicate every packet that enters each interface out to a single ...
1
vote
1answer
1k views
nftables remove all rules in chain
I have a number of rules in table mytable chain mychain:
> sudo nft -a list table mytable
table ip mytable { # handle 8
chain mychain { # handle 1
type filter hook input ...
1
vote
1answer
38 views
NFTable clarification
I need some clarification. If I add this rule
nft add rule ip filter INPUT ip daddr 127.0.0.1 drop
nftables will ignore it and never acknowledge because it is on end of the rules?
0
votes
1answer
2k views
nftables doesn't work even though config file exists
I'm using nftables on Debian 10.
There is my config file
# cat /etc/nftables.conf
#!/usr/sbin/nft -f
flush ruleset
table inet filter {
chain input {
type filter hook input ...
2
votes
0answers
2k views
Fail2ban & nftables errors, IPs not banned
So I've been experimenting with nftables in CentOS 8 and things are going pretty well, but I'm having a weird problem with fail2ban.
Fail2ban cannot ban IPs with nftables-multiport or nftables-...
0
votes
1answer
724 views
nftables allow redis only from specific IP addresses
I am configuring a REDIS server and I want to allow connections only from a set of specific IP addresses.
This is a Debian 10 server, and the recommended framework to use is nft, which I haven't used ...
2
votes
1answer
1k views
firewall: nftable counter rules
A few months ago, I migrated the firewall of a debian laptop from iptables to nftables, using debian's recommended procedure, and all seems to have been fine. Now, months later, I'm scrutinizing the ...
3
votes
1answer
4k views
Port forwarding & NAT with nftables
I have an OpenWRT gateway (self-built 19.07, kernel 4.14.156) that sits on a public IP address in front of my private network. I am using nftables (not iptables).
I would like to expose a non-...
1
vote
0answers
34 views
nftables chains and priority problem [duplicate]
I have two output chains like this:
chain OUT {
type filter hook output priority 0; policy accept;
ct state established,related accept
oif "lo" counter packets 0 bytes 0 accept
ip ...
6
votes
1answer
6k views
CentOS 8 firewalld + nftables or just nftables
I've been on CentOS 7 for a long time and was used to building my custom iptables configurations on a variety of both personal and business boxes.
I've recently started working with CentOS 8 and ...
2
votes
1answer
279 views
How do you filter packets differently based on time of day in nftables?
I would like to e.g. block certain traffic between 00:00 and 04:00. Is this possible in nftables?
(Obviously I can just set a cron job that changes the config at these times - but I would like to ...
3
votes
2answers
578 views
Using custom tables in nft
I have a Fedora 31 system on which I am using iptables-nft. I need this because there is still a bunch of software that expects the legacy iptables command line tools. This means that my nftables ...
1
vote
1answer
310 views
nftables rules not blocking traffic
I am testing NFtables and am attempting to set up a basic routing firewall on a linux machine with 2 interfaces, ens37 and ens38. Here is the ifconfig output for these 2 interfaces.
ens37: flags=4163&...
