Questions tagged [nftables]

nftables is the successor of iptables/ip6tables and available since Linux kernel version 3.13

Filter by
Sorted by
Tagged with
0 votes
1 answer
16 views

natables routing decision step(s)

On the link below is an image explaining packet flow across chains in nftables Netfilter hooks I understanding everything except one thing, the image does not explain at which stage is routing ...
metablaster's user avatar
0 votes
1 answer
16 views

usage and meaning of masquerade [to :PORT_SPEC]

Here is relevant example ruleset with 2 sample nftables NAT rules which masquerade IP from virtual machine to LAN: #!/usr/sbin/nft -f add table nat_4 # Sees all packets after routing, just before ...
metablaster's user avatar
1 vote
1 answer
10 views

Declare and use a named set of ICMP types in nftables

Here is a working example on how I currently use an unamed set containing ICMP types: #!/usr/sbin/nft -f add table filter_4 add chain filter_4 icmp_out_4 { comment "Output ICMPv4 traffic&...
metablaster's user avatar
1 vote
1 answer
8 views

Declare ct helper object outside table declaration scope in nftables

Here is a working example of how ct helper object is currently declared as per nftables docs #!/usr/sbin/nft -f add table filter_4 { # TODO: Can helper object be declared outside the scope of ...
metablaster's user avatar
-1 votes
0 answers
16 views

An nft ruleset is disabling my internet, why?

Wireguard is creating the following nft rules, that is having an effect of breaking my internet. ~$ sudo nft list ruleset table ip wg-quick-wg0 { chain preraw { type filter ...
Rachel1983's user avatar
0 votes
1 answer
24 views

nftables priority filter: what does this mean?

The nftables wiki explains the priorities here. Clearly, the priority is a numeric value like -10, 0 or 10. The Red Hat nftables documentation does the same. Priorities remain numeric in the examples ...
CeSinge's user avatar
  • 23
0 votes
0 answers
31 views

nftables rules apparently blocking ssh traffic - could it be special characters?

I have a set of nftable rules of the following form: chain INPUT { type filter hook input priority filter; policy drop; ip saddr 11.37.79.97/29 counter packets 0 bytes 0 log prefix ...
wolfsshield's user avatar
0 votes
0 answers
18 views

nftables: forward HTTP traffic to a box behind NAT

I have a debian system as a gateway. My nftables.conf is pretty simple: #!/usr/sbin/nft -f flush ruleset table inet filter { chain input { type filter hook input priority ...
LD1117's user avatar
  • 11
2 votes
2 answers
72 views

Does nftables allow port 22 or other ports by default?

I installed nftables on a new Debian 12 (on AWS EC2). I am connected to the instance (the external EC2 IP) over port 22/tcp. I mention EC2 because maybe they do weird tricks. I then installed nftables ...
CeSinge's user avatar
  • 23
1 vote
1 answer
64 views

nftables - multicast packets not matched

I've set up a rule to match multicast packets as follows: add rule filter_4 new_out_4 meta pkttype multicast goto multicast_out_4 filter_4 is IPv4 table, new_out4 is output chain and multicast_out_4 ...
metablaster's user avatar
0 votes
0 answers
34 views

How to SNI filter with nftables v1.0.8?

eg: permit classroom and block youtube which share an IP: dig www.youtube.com +short | grep "$(dig classroom.google.com +short)" 142.251.32.78 https://serverfault.com/questions/988309/...
user1133275's user avatar
  • 5,574
2 votes
1 answer
20 views

arptables not working with nmap

I'm trying to implement a way to prevent network scans from my notebook. One of the things I want is to allow arp request to specific hosts, like my gateway. I added some rules using arptables and ...
Alberto Pires's user avatar
1 vote
0 answers
48 views

ksoftirqd taking a lot of cpu since moving to debian 12

I have a small pc linux box like intel nuc dual atom where I run some firewall settings. Previously this machine runned debian 9 and everything worked fine. I could have used the machine in middle of ...
user3450548's user avatar
  • 2,900
0 votes
1 answer
33 views

What is the proper method to install a Debian package onto a device stuck on a private network? [duplicate]

Here is my scenario: I want to install iptables onto an embedded Linux device that is located on a private network with no access to the internet. I can place my Windows PC onto this network and then ...
Izzo's user avatar
  • 961
2 votes
1 answer
38 views

nft port forwarding not working on router

I have a machine that serves both as a router and a server. I have several lxc containers on this machine, and want to expose them to both the LAN and WAN. Following https://access.redhat.com/...
byteit101's user avatar
  • 123
0 votes
1 answer
30 views

Abort nftables port forwarding NAT flows

I am doing dynamic, short-lived UDP port forwarding based on source address to destination port tuples. This works fine using nftables with maps, lookups and appropriate rules (nat in a prerouting / ...
yawn's user avatar
  • 101
2 votes
2 answers
93 views

nftables how to temporarily allow a port(s) for an application

I am using Warpinator on my android phone to transfer files between my linux machines and my mobile phone. The application uses ports for 42001 for initial connection, and 42000 for data transfer. I ...
benibilme's user avatar
0 votes
0 answers
35 views

Nftables to do scalable MAC translation in NAPT-style

I'm a networking senior guy steadily diving more into Linux internals over last 5 years, grasping networking caps a lot, however just arriving at Netfilter domain and learning of nftables last 3-4 ...
PeterG's user avatar
  • 1
1 vote
1 answer
67 views

Ubuntu router using nftables blocking traffic

I'm trying to set up a simple router in Ubuntu. There are two network interfaces: eth0 - a wired network interface connected to the internet, and wlan0 - configured as an AP with IP address 10.0.9.1. ...
Martin Claesson's user avatar
0 votes
0 answers
33 views

Combining DNAT and SYNPROXY in NFTABLES

I have an application that requires DNAT for load balancing and SYNPROXY to mitigate SYN floods. Absent SYNPROXY, I would put the round-robin DNAT into a NAT chain on the PREROUTING hook. However, ...
Dominic's user avatar
0 votes
0 answers
19 views

Can tc or nftables change the SA/TA in 802.11 frame?

I am looking for a way to change the SA/TA on a Wi-Fi frame. I need this because I have a VM (running with QEMU and vmnet-bridged) in a MacBook that connects to a Wi-Fi interface, and a laptop ...
amkgi's user avatar
  • 103
0 votes
1 answer
166 views

How to exclude dnsmasq used by libvirt from Mullvad VPN's "local network sharing" block

I don't use the local network expect dnsmasq for libvirt. With blocking local network I have no DNS on my VM. For that reason I want to exclude dnsmasq from the local network sharing block with split ...
clooney's user avatar
  • 81
0 votes
1 answer
422 views

What loads nft_compat

I am running AlmaLinux 9, and on boot I see warning Warning: Deprecated Driver is detected: nft_compat will not be maintained in a future major release and may be disabled but what is loading that ...
TSG's user avatar
  • 1,698
2 votes
1 answer
2k views

Ubuntu 22.04 iptables command not working

Totally new to netfilter thing, currently am running an application which uses three interfaces eth0/eth1/eth2, my application will run on two servers and they both can communicate between them via ...
RaGa__M's user avatar
  • 169
1 vote
1 answer
185 views

nftables: Are chains of multiple types all evaluated for a given hook?

This is a question specifically about nftables chain types in the Linux kernel. I don't understand how they're processed. I've been staring at the kernel code for a while, and it looks to me like an ...
dsedivec's user avatar
  • 113
0 votes
0 answers
69 views

How to ban IPs at gateway with fail2ban on multiple backend servers?

I have configured fail2ban successfully on multiple backend servers on my network and it's all ok -- except that I would like a ban originating from eg email to be banned not just for email but all ...
Ruth Ivimey-Cook's user avatar
0 votes
1 answer
39 views

Unable to make MAC Adress accessible in nftables

I have an Oculus Quest and I want only the Oculus to be able to see my miniDLNA server. So on the server itself I have the following config: The Mac Adress I've given is 100% correct and when ...
Iron Dude's user avatar
0 votes
0 answers
94 views

how do I properly isolate the containers with firewalld with iptables=false?

I do not want the docker modify my iptables/nftables on fly so I decided to use iptables=false. I then follow the suggestion here to enable the outbound internet connection inside the containers. ...
Wang's user avatar
  • 1,296
1 vote
0 answers
41 views

use nftables to open wlan0 and limit eth0 to out only

I'm using Raspberry Pi3+ (Buster 6.1) as MQTT broker on wlan0 (AP serving dhcp to IOT) and using eth0 (gets dhcp from house router) to get NTP and send notifications through Gmail. It all works, now ...
JustDucky's user avatar
0 votes
1 answer
157 views

How to re-use the same nftables set for both saddr and daddr?

I am using the following nftables config to whitelist machines that can use the router: table bridge filter { set authorized { typeof ether saddr flags constant elements = {...
Greendrake's user avatar
0 votes
0 answers
83 views

nftables set (verb) with concatenation

Note: This is about using concatentation (.) from a set to use the set verb to modify parts of the packet (e.g. ip daddr set 1.2.3.4). I don't seem to be able to find the specific nomenclature from ...
Synthetic Ascension's user avatar
1 vote
1 answer
223 views

nftables dnat map rule failing silently

I'm working from the answer of this question and man nft in order to create some dnat rules in my nftables config. The relevant config extract is: define src_ip = 192.168.1.128/26 define dst_ip ...
Synthetic Ascension's user avatar
0 votes
0 answers
96 views

nftables - Setting destination MAC still sending ARP requests

I'm trying to run DHCP servers behind a private Docker bridge. I'm at a point where I can reroute the DHCPDISCOVER broadcast packets to the DHCP server behind the Docker bridge and have the DHCP ...
Synthetic Ascension's user avatar
0 votes
0 answers
96 views

Nftables does not work as expected to block with meter

Goal: Account for excess packets whose rate source IP and destination port are greater than 200 packets per second, example: 1s, 2s, 3s ...: IP 1.1.1.1 to MyServer:80 [This happens 201 times in ...
Gabriel's user avatar
0 votes
0 answers
176 views

nftables - Forward layer 2 broadcast (DHCP) without ingress chain?

I'm currently looking into setting up DHCP servers behind a Docker bridge. My docker bridges are brought up with docker compose. I'm looking for a way to forward incoming DHCPDISCOVER requests to the ...
Synthetic Ascension's user avatar
0 votes
0 answers
30 views

Responses to NF_STOLEN packets aren't hitting NAT rules

I'm currently working on placing DHCP servers within a Docker bridged network. To ensure packets get through I have the following: table netdev filterearly_lan10{ chain ingress { type ...
Synthetic Ascension's user avatar
0 votes
1 answer
126 views

nftables counter for nat'ed traffic

When setting up a counter for a rule in a 'type nat hook prerouting' chain with dnat on a specific port, the counter will only count the initial packet for that rule and the following packets from ...
user3767974's user avatar
0 votes
2 answers
189 views

Can netfilter act as a DHCP relay?

I'm wondering whether instead of using a DHCP relay netfilter (be that tc or nftables) can be used to route DHCP broadcast packets to a Docker container attached to a bridge. The reasoning for this is ...
Synthetic Ascension's user avatar
0 votes
0 answers
236 views

Error: Could not process rule: No such file or directory

I'm trying to configure a tap connection on my host os (devuan 4) on my ARM chromebook because I want to use it with qemu and the guest os that I want to virtualize on top of devuan,using qemu+kvm,...
Marietto's user avatar
  • 531
1 vote
1 answer
483 views

How to understand the nftables "add @my_ssh_meter { ip saddr limit rate 10/second } accept" rule?

nftables supports dynamically populated sets which are documented in nftables wiki. The first example on the wiki page is following: table ip my_filter_table { set my_ssh_meter { ...
Martin's user avatar
  • 7,546
1 vote
1 answer
581 views

nftables deleting a rule without passing handle (similar to iptables delete)

iptables syntax for delete is much simpler. if we replace the "append" with delete we get command for deletion of the rule. nftable provides similar construct for few rule management aspect ...
Amit Priyadarshi's user avatar
3 votes
1 answer
354 views

nftables, masquerade: packets go through wrong outbounding interface

What I am doing is quite simple, I use port forwarding and enable masquerading on the POSTROUTING chain: table inet nat { chain prerouting { type nat hook prerouting priority -100; policy ...
Tintenfisch's user avatar
1 vote
1 answer
203 views

Can nftables perform postrouting matching on crgroupv2?

I would like to change source address of every packet generated by a process in given cgroup (version 2). Is that even possible? I have: nftables 1.0.2, linux 5.15 (Ubuntu variant) /system.slice/...
sharpener's user avatar
  • 135
0 votes
0 answers
25 views

nft (!token) list reports [invalid type] but returns no cli error

I entered: sudo nft 'insert rule inet firewalld filter_INPUT meta l4proto {tcp,udp} ct state related,established ct original proto-dst 53 counter packets 0 accept But nft list says: meta l4proto { ...
ArrowInTree's user avatar
0 votes
1 answer
164 views

writing nftables for traffic pre/postrouting to an IDS

Trying to learn nftables since it has been implemented on Openwrt 22.03 with little backwards compatibility for iptables. I have iptables rules for forwarding traffic from my router to a VM running ...
robreiner's user avatar
-3 votes
1 answer
277 views

Has anybody gotten nft ct subcommands to work?

I am trying to transition from iptables to nftables but the ct subcommands (timeouts, setmarks, status, l3proto, expectations etc but expectations are mentioned in the error message) are not being ...
ArrowInTree's user avatar
0 votes
1 answer
84 views

How to avoid insert repeated rules in nftables

In nftables I have this table inet my_table { chain badips { ip saddr 185.165.190.17 counter packets 0 bytes 0 drop } type filter hook input priority filter; policy drop; ...
somenxavier's user avatar
2 votes
1 answer
196 views

nftables does not limit ipv6 traffic in rate limit rule in bridge and ip6 family

I have a wifi router where the wlan0 interface (radio interface) is bridged with the ethernet interface eth0 (connected to another server acting as DHCP) / # brctl show br0 bridge name bridge id ...
Haswell's user avatar
  • 141
0 votes
0 answers
27 views

Why do chains in Bridge type tables have different (default) priority values in nftables?

As the man page clearly shows https://www.netfilter.org/projects/nftables/manpage.html , the default "filter" priority value for Bridge table chains -200, while it is 0 for all table types, ...
T Nierath's user avatar
  • 216
0 votes
1 answer
325 views

How to convert iptables to nftables

I need to use nftables, instead of iptables. How can I convert the following to nftables format instead of iptables? sysctl net.ipv4.ip_forward=1 iptables -t nat -A PREROUTING -p tcp --dport 22 -j ...
Crow's user avatar
  • 1

1
2 3 4 5