Questions tagged [nftables]

nftables is the successor of iptables/ip6tables and available since Linux kernel version 3.13

Filter by
Sorted by
Tagged with
0 votes
0 answers
14 views

Is there a nice nftables ruleset visualizer?

I have a rather large firewall ruleset in nftables. nft list ruleset is many pages. It's possible to export the data in machine readable format (JSON), using nft -j list ruleset, but before I write my ...
user avatar
  • 123
3 votes
1 answer
83 views

How to open additional ports with nftables?

I'm running a Debian Linux server. I need to open some firewall ports; usually this is easy as pie with iptables, but this server is running nftables. When I open the conf file, it's not showing rules:...
user avatar
  • 31
1 vote
1 answer
36 views

How to avoid allowing ephemeral port range rule in nftables

I am using Ubuntu 20.04 OS with dnsjava client library to query DNS servers. I have nftables rule in this machine which block all traffic on ports except ephemeral port range 32768-61000 which will be ...
user avatar
0 votes
0 answers
33 views

How to limit web usage with nftables?

Between certain times, I would like to limit the amount of internet browsing I can do to force myself to focus (something like visiting ~3 sites per minute). This is what I came up with: table inet ...
user avatar
  • 395
0 votes
0 answers
42 views

Using Wireguard to expose Minikube services on a VM

Due to hitting bugs running Minikube on BTRFS, I am running it now on a QEMU Fedora 35 guest VM on Fedora 35 host. I can use ssh -fNL port forwards to access the Podman diven network services in the ...
user avatar
  • 151
1 vote
0 answers
306 views

How do i convert iptables rules to nftables rules?

I was trying to figure out how to convert my iptables rules to nftables rules on an Ubuntu system. I tried to convert iptables to nftables using the automated converter, but it didn't appear to work. ...
user avatar
2 votes
1 answer
114 views

Web server cannot access itself through public ip address on nftables port forwarding

I have a WireGuard server as the edge router. Forwarding all http traffic to my web server. Everything works fine but there is a problem. The web server cannot access itself through the WireGuard ...
user avatar
  • 23
1 vote
1 answer
41 views

Can I use something else than curly bracket in nftables.conf?

I am trying to template stateful nftables configuration file with Ansible. Ansible uses Jinja for templating and Jinja uses curly braces for variables: {{ variable }} Nftables configuration uses ...
user avatar
  • 23
1 vote
1 answer
330 views

Understanding docker port forwarding and iptables/nftables

Given a fairly common firewall setup with nftables/iptables (OUTPUT accept, INPUT/FORWARD accept established+related, default drop): table ip nat { chain DOCKER { iifname "docker0&...
user avatar
1 vote
1 answer
38 views

nftables log output interface blank

I have nftables set to log when it drops packets. I'm trying to work out specifically how communication between docker containers is blocked. The log shows the following entry: IN=br-0353a07849d5 OUT= ...
user avatar
3 votes
1 answer
120 views

How do I block Tor on Linux?

I want to block Tor Browser on a Linux computer (Debian 10). Being more specific: I want to block local users from launching Tor browser on this machine. There is a single user account on the system ...
user avatar
0 votes
0 answers
26 views

How to drop packets to port 5901 other than localhost with nftables

I was trying to block VNC port 5901 from internet but accessible from localhost. I have a docker container running on the server, which works fine. After the following 2 commands, I still can access ...
user avatar
0 votes
1 answer
29 views

nftables port forward causes network requests to fail

I am trying to forward some ports from a public IP 172.10.22.22 to a remote VPN IP 10.22.22.22. The local VPN IP is 10.22.22.1 The ethernet interface is eth0 The wireguard vpn interface is wg0 These ...
user avatar
  • 101
0 votes
0 answers
48 views

Configuring NAT for the TAP interface

I am trying to configure NAT with nftables for the TAP interface as follows: table ip vm_nat { chain vm_prerouting { type nat hook prerouting priority dstnat; } chain ...
user avatar
1 vote
1 answer
81 views

nftables rate limit whitelist

Following this article on nftables Blocking IP addresses that attempt more than ten new incoming TCP connections within one minute how would one add a whitelist like ip saddr != { ip1, ip2,... }? ...
user avatar
  • 11
3 votes
1 answer
246 views

What is the relationship or difference among iptables, xtables, iptables-nft, xtables-nft, nf_tables, nftables

I have been reading for a while now. What I understood is: nftables is the modern Linux kernel packet classification framework. nftables is the successor to iptables. It replaces the existing ...
user avatar
  • 1,181
0 votes
1 answer
60 views

How can I filter a packet after an iptables MASQUERADE?

I am trying to build a multi-WAN router based on Debian Buster (kernel version 4.19). It has multiple 'LAN-side' network interfaces (e.g. lan0, lan1, ... lanM), and also multiple 'WAN-side' interfaces ...
user avatar
  • 101
0 votes
1 answer
250 views

How to get logs with nftables, ulogd

I have this nftables ruleset which resulted mainly from setting up the simple stateful firewall from Arch Wiki. I then have configured ulogd like this. When ulogd starts up, I see this log output in /...
user avatar
  • 151
0 votes
1 answer
85 views

nftables refuses to add chain

I am trying to run the following nft commands: nft add table netdev filter nft -- add chain netdev filter input { type filter hook ingress device vlan100 priority -500 \; policy accept \; } nft add ...
user avatar
  • 285
0 votes
0 answers
36 views

My firewall does not work and I can easily access the web using http and https

I can easily acsess the web , using http protocols however my firewall should reject traffic from http and https , does anyone know why this is?? #!/usr/sbin/nft -f table inet block_https { ...
user avatar
1 vote
0 answers
48 views

How can I idempotently add an input rule to preconfigured nftables

I have a utility that needs a free tcp port. As I don't want to alter existing configuration files I need to be able to dynamically add a rule to nftables. There is an inet table called filter with ...
user avatar
  • 111
1 vote
2 answers
391 views

Unable to run scripts as sudo with the www-data user in Debian

I am setting up a captive portal on a Raspberry Pi (latest distro CLI) where my web application will change NFTables rules based on who is logged in. I have a LEMP stack set up; with Laravel 8 as the ...
user avatar
  • 13
0 votes
1 answer
237 views

nftables refuses to add rules "Error: Could not process rule: No such file or directory"

Problem: When trying to add nft rules, I keep getting "Error: Could not process rule: No such file or directory" Example command: nft add rule netdev filter input ip daddr 10.10.10.10 ...
user avatar
  • 285
0 votes
0 answers
72 views

Nftables rule to change default gateway for a packet

How can we change the default gateway for a packet. Scenario: Packet with destination 10.0.1.19 goes via default gateway 10.0.0.1 How can we force 10.0.1.19 to go via default gateway 10.3.0.1 using ...
user avatar
  • 613
0 votes
2 answers
46 views

Debian Bullseye Custom install on VPS

I have an idea-question. There is a clean install of Bullseye on a VPS. This distro has new Bind, new Dovecot, new Apache, etc. If I back it up and then re-install it EXCLUDING new Bind, new Dovecot ...
user avatar
  • 105
0 votes
1 answer
70 views

Firewalld show rich rules without zone

May someone could help me with firewalld. I need to add rich rules with no associated zone, as the source / destination networks are all remote. For example: firewall-cmd --add-rich-rule='rule family=&...
user avatar
2 votes
1 answer
586 views

Why MSS clamping in iptables(-nft) seems to take no effect in nftables?

My pppoe client automatically adds an iptables rule iptables -t mangle -o "$PPP_IFACE" --insert FORWARD 1 -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:65495 -j TCPMSS --clamp-mss-to-...
user avatar
-1 votes
1 answer
215 views

What's the idiomatic way to allow incoming connections on a TCP port, as of 2021?

It's been years since I last fiddled with firewall rules; and I remember the iptables chains for input, forward and output, and their various rules. But the times, they have a-changed, and today ...
user avatar
  • 7,249
3 votes
1 answer
440 views

nftables map `port` to `ip:port` for DNAT

Is it possible to have an nftables map which maps port to ipv4_addr:port, where port and ipv4_addr:port have different TCP port numbers? For example, I want to dnat all incoming packets on port 80 to ...
user avatar
1 vote
1 answer
270 views

nftables table and chain priority

I have a problem with my nftables setup. I have two tables, each one has a chain with the same hook but a different name and priority. The tables are in different files which are loaded by an include ...
user avatar
0 votes
1 answer
281 views

nftables: how to use 1 common map (or set) for different but related rules? (dnat + forward)

I am setting up a firewall + NAT using nftables (v0.9.6). The tool provides sets & maps to avoid a lot of rule duplication. I want to use one common data structure (set or map) to configure both ...
user avatar
  • 17.6k
2 votes
3 answers
4k views

Correct way to switch back to iptables on debian 10 or 11

With debian 10 and 11 nftables is the new firewalling framework. I have some machines that rely heavily on a old custom iptables config, aside from that I can easily move everything to new debian 10/...
user avatar
  • 2,434
0 votes
1 answer
114 views

Is there any linux alternative of macOS application firewall?

By alternative it's not meant the program needs to be gui. Any method that allows a program to logs when something calls listen() and only allows selected programs to listen to the interface:port will ...
user avatar
0 votes
1 answer
107 views

Delete illegal router from network

I have a default gateway with IP address 192.168.1.1 and MAC address 5c:77:76:6e:0d:7b. It is my only wi fi modem router from which I receive internet. But in input nftables logs I saw another one ...
user avatar
  • 74
1 vote
1 answer
267 views

What chain types are supported by the nftables NETDEV family?

From the nftables Quick reference: family refers to a one of the following table types: ip, arp, ip6, bridge, inet, netdev. and type refers to the kind of chain to be created. Possible types are: ...
user avatar
  • 2,191
1 vote
1 answer
671 views

Porting Iptables to Nftables firewall with conntrack marks

Hi dear esteemed community, I'm having a hard time porting my very functional iptables firewall to nftables. No issues with input/output/forward stuffs, it's mainly the conntrack marking. What I ...
user avatar
  • 13
1 vote
1 answer
76 views

blocking obsolete tcp options

On Linux, I want to drop all packets that contain any obsolete tcp options. By obsolete options, I mean all those with a tcp option kind number above 8. How can I do this using nftables? For example, ...
user avatar
1 vote
1 answer
427 views

Understanding nftables logs

What happened during these logs entry events below? Nov* 8 09:37:12 kernel: [10967.520783] New Input packets: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.2 DST=192.168.1.2 ...
user avatar
  • 74
2 votes
1 answer
545 views

How to filter ARP-Requests with Nftables using a Raspberry Pi as AP (using hostapd)

I´m trying to filter ARP-requests coming from certain IP-addresses in my network. I tried : table arp filter { chain input { type filter hook input priority 0; policy drop; ...
user avatar
0 votes
1 answer
123 views

How to use a set as a key in a (v)map?

For example, one can: ip saddr vmap { 192.168.1.2: goto chain_a, 192.168.1.6: goto chain_b } but apparently not: ip saddr vmap { { 192.168.1.2, 192.168.1.4 }: goto chain_a, { 192.168....
user avatar
  • 392
0 votes
1 answer
472 views

Router with nftables doesn't work well

I have Debian 4.19.194-1 as a router server with LAN, WAN, PPPOE (as gateway) and COMPUTER1 in LAN network which should have access to internet through Debian router. As firewall I use nftables with ...
user avatar
3 votes
1 answer
427 views

nftables Error: syntax error, unexpected saddr

I wanted to add the rule arp saddr ip 192.168.2.1 counter accept to my Nftables firewall. When reading the config-file with sudo nft -f /etc/nftables2.conf, I get the error-message /etc/nftables2.conf:...
user avatar
1 vote
1 answer
226 views

Nftables not matching TOS value in IP packets

This is on Ubuntu 20.04. I am attempting to write a rule for nftables which will match all IP packets received on interface eth1 that have a specific TOS value (0x02). My attempt so far: sudo nft add ...
user avatar
2 votes
1 answer
3k views

nftables whitelisting docker

I have two docker containers running on my machine where a very restrictive nftables configuration is active. I'd like to keep it that way but whitelist access to the docker containers from outside. ...
user avatar
  • 125
0 votes
0 answers
54 views

nftables table will not permanently flush

I have a Centos 8 machine in testing where I've disabled firewalld. I'm attempting to use nftables directly. I have a /etc/sysconfig/nftables.conf that has a table defined as I like. However there is ...
user avatar
  • 21
0 votes
1 answer
480 views

iptables string rules translation to nftables

I am migrating rules from iptable's to nftable's by following Moving from iptable to nftable I now have few IPs and ports block rule in place along with a string based iptable rules but by using the ...
user avatar
0 votes
1 answer
123 views

Connect to server behind NAT from LAN using real IP

I have a small network. It has a firewall connected to the internet (WAN) with real IP and DNS name which also acts as a DHCP server for the internal network (LAN). On the firewall machine I've setup ...
user avatar
  • 293
1 vote
1 answer
131 views

An upper limit on the number of rules nftables can realistically process

I am designing a large SaaS VPN service and am planning to use nftables. Is there a realistic limit to the number of rules it can process? Rules will be compiled from a database. There will be ...
user avatar
2 votes
1 answer
756 views

How to reset sessions in nat table?

I have two virtual machines (router and client) ubuntu server 18 04, the router is the gateway for the client.Nftables are installed on the router and a NAT table is created with two chains pre and ...
user avatar
  • 57
0 votes
1 answer
535 views

`nft flush ruleset` can't delete all rules permanently?

List all ruleset currently: sudo nft list ruleset table inet filter { chain input { type filter hook input priority 0; policy accept; iif "lo" accept } chain ...
user avatar
  • 35