Questions tagged [nftables]
nftables is the successor of iptables/ip6tables and available since Linux kernel version 3.13
138
questions
0
votes
0
answers
14
views
Is there a nice nftables ruleset visualizer?
I have a rather large firewall ruleset in nftables. nft list ruleset is many pages.
It's possible to export the data in machine readable format (JSON), using nft -j list ruleset, but before I write my ...
- 123
3
votes
1
answer
83
views
How to open additional ports with nftables?
I'm running a Debian Linux server.
I need to open some firewall ports; usually this is easy as pie with iptables, but this server is running nftables.
When I open the conf file, it's not showing rules:...
- 31
1
vote
1
answer
36
views
How to avoid allowing ephemeral port range rule in nftables
I am using Ubuntu 20.04 OS with dnsjava client library to query DNS servers.
I have nftables rule in this machine which block all traffic on ports except ephemeral port range 32768-61000 which will be ...
- 133
0
votes
0
answers
33
views
How to limit web usage with nftables?
Between certain times, I would like to limit the amount of internet browsing I can do to force myself to focus (something like visiting ~3 sites per minute). This is what I came up with:
table inet ...
- 395
0
votes
0
answers
42
views
Using Wireguard to expose Minikube services on a VM
Due to hitting bugs running Minikube on BTRFS, I am running it now on a QEMU Fedora 35 guest VM on Fedora 35 host. I can use ssh -fNL port forwards to access the Podman diven network services in the ...
- 151
1
vote
0
answers
306
views
How do i convert iptables rules to nftables rules?
I was trying to figure out how to convert my iptables rules to nftables rules on an Ubuntu system.
I tried to convert iptables to nftables using the automated converter, but it didn't appear to work.
...
- 11
2
votes
1
answer
114
views
Web server cannot access itself through public ip address on nftables port forwarding
I have a WireGuard server as the edge router. Forwarding all http traffic to my web server.
Everything works fine but there is a problem. The web server cannot access itself through the WireGuard ...
- 23
1
vote
1
answer
41
views
Can I use something else than curly bracket in nftables.conf?
I am trying to template stateful nftables configuration file with Ansible.
Ansible uses Jinja for templating and Jinja uses curly braces for variables:
{{ variable }}
Nftables configuration uses ...
- 23
1
vote
1
answer
330
views
Understanding docker port forwarding and iptables/nftables
Given a fairly common firewall setup with nftables/iptables (OUTPUT accept, INPUT/FORWARD accept established+related, default drop):
table ip nat {
chain DOCKER {
iifname "docker0&...
- 230
1
vote
1
answer
38
views
nftables log output interface blank
I have nftables set to log when it drops packets. I'm trying to work out specifically how communication between docker containers is blocked.
The log shows the following entry:
IN=br-0353a07849d5 OUT= ...
- 230
3
votes
1
answer
120
views
How do I block Tor on Linux?
I want to block Tor Browser on a Linux computer (Debian 10).
Being more specific: I want to block local users from launching Tor browser on this machine.
There is a single user account on the system ...
- 31
0
votes
0
answers
26
views
How to drop packets to port 5901 other than localhost with nftables
I was trying to block VNC port 5901 from internet but accessible from localhost. I have a docker container running on the server, which works fine. After the following 2 commands, I still can access ...
- 1
0
votes
1
answer
29
views
nftables port forward causes network requests to fail
I am trying to forward some ports from a public IP 172.10.22.22 to a remote VPN IP 10.22.22.22. The local VPN IP is 10.22.22.1
The ethernet interface is eth0
The wireguard vpn interface is wg0
These ...
- 101
0
votes
0
answers
48
views
Configuring NAT for the TAP interface
I am trying to configure NAT with nftables for the TAP interface as follows:
table ip vm_nat {
chain vm_prerouting {
type nat hook prerouting priority dstnat;
}
chain ...
- 1
1
vote
1
answer
81
views
nftables rate limit whitelist
Following this article on nftables Blocking IP addresses that attempt more than ten new incoming TCP connections within one minute how would one add a whitelist like ip saddr != { ip1, ip2,... }?
...
- 11
3
votes
1
answer
246
views
What is the relationship or difference among iptables, xtables, iptables-nft, xtables-nft, nf_tables, nftables
I have been reading for a while now.
What I understood is:
nftables is the modern Linux kernel packet classification framework. nftables is the successor to iptables. It replaces the existing ...
- 1,181
0
votes
1
answer
60
views
How can I filter a packet after an iptables MASQUERADE?
I am trying to build a multi-WAN router based on Debian Buster (kernel version 4.19). It has multiple 'LAN-side' network interfaces (e.g. lan0, lan1, ... lanM), and also multiple 'WAN-side' interfaces ...
- 101
0
votes
1
answer
250
views
How to get logs with nftables, ulogd
I have this nftables ruleset which resulted mainly from setting up the simple stateful firewall from Arch Wiki. I then have configured ulogd like this. When ulogd starts up, I see this log output in /...
- 151
0
votes
1
answer
85
views
nftables refuses to add chain
I am trying to run the following nft commands:
nft add table netdev filter
nft -- add chain netdev filter input { type filter hook ingress device vlan100 priority -500 \; policy accept \; }
nft add ...
- 285
0
votes
0
answers
36
views
My firewall does not work and I can easily access the web using http and https
I can easily acsess the web , using http protocols however my firewall should reject traffic from http and https , does anyone know why this is??
#!/usr/sbin/nft -f
table inet block_https {
...
1
vote
0
answers
48
views
How can I idempotently add an input rule to preconfigured nftables
I have a utility that needs a free tcp port. As I don't want to alter existing configuration files I need to be able to dynamically add a rule to nftables.
There is an inet table called filter with ...
- 111
1
vote
2
answers
391
views
Unable to run scripts as sudo with the www-data user in Debian
I am setting up a captive portal on a Raspberry Pi (latest distro CLI) where my web application will change NFTables rules based on who is logged in. I have a LEMP stack set up; with Laravel 8 as the ...
- 13
0
votes
1
answer
237
views
nftables refuses to add rules "Error: Could not process rule: No such file or directory"
Problem:
When trying to add nft rules, I keep getting "Error: Could not process rule: No such file or directory"
Example command:
nft add rule netdev filter input ip daddr 10.10.10.10 ...
- 285
0
votes
0
answers
72
views
Nftables rule to change default gateway for a packet
How can we change the default gateway for a packet.
Scenario:
Packet with destination 10.0.1.19 goes via default gateway 10.0.0.1
How can we force 10.0.1.19 to go via default gateway 10.3.0.1 using ...
- 613
0
votes
2
answers
46
views
Debian Bullseye Custom install on VPS
I have an idea-question. There is a clean install of Bullseye on a VPS. This distro has new Bind, new Dovecot, new Apache, etc. If I back it up and then re-install it EXCLUDING new Bind, new Dovecot ...
- 105
0
votes
1
answer
70
views
Firewalld show rich rules without zone
May someone could help me with firewalld. I need to add rich rules with no associated zone, as the source / destination networks are all remote. For example:
firewall-cmd --add-rich-rule='rule family=&...
- 1
2
votes
1
answer
586
views
Why MSS clamping in iptables(-nft) seems to take no effect in nftables?
My pppoe client automatically adds an iptables rule iptables -t mangle -o "$PPP_IFACE" --insert FORWARD 1 -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:65495 -j TCPMSS --clamp-mss-to-...
- 353
-1
votes
1
answer
215
views
What's the idiomatic way to allow incoming connections on a TCP port, as of 2021?
It's been years since I last fiddled with firewall rules; and I remember the iptables chains for input, forward and output, and their various rules. But the times, they have a-changed, and today ...
- 7,249
3
votes
1
answer
440
views
nftables map `port` to `ip:port` for DNAT
Is it possible to have an nftables map which maps port to ipv4_addr:port, where port and ipv4_addr:port have different TCP port numbers? For example, I want to dnat all incoming packets on port 80 to ...
- 33
1
vote
1
answer
270
views
nftables table and chain priority
I have a problem with my nftables setup.
I have two tables, each one has a chain with the same hook but a different name and priority.
The tables are in different files which are loaded by an include ...
- 13
0
votes
1
answer
281
views
nftables: how to use 1 common map (or set) for different but related rules? (dnat + forward)
I am setting up a firewall + NAT using nftables (v0.9.6). The tool provides sets & maps to avoid a lot of rule duplication.
I want to use one common data structure (set or map) to configure both ...
- 17.6k
2
votes
3
answers
4k
views
Correct way to switch back to iptables on debian 10 or 11
With debian 10 and 11 nftables is the new firewalling framework.
I have some machines that rely heavily on a old custom iptables config, aside from that I can easily move everything to new debian 10/...
- 2,434
0
votes
1
answer
114
views
Is there any linux alternative of macOS application firewall?
By alternative it's not meant the program needs to be gui. Any method that allows a program to logs when something calls listen() and only allows selected programs to listen to the interface:port will ...
- 31
0
votes
1
answer
107
views
Delete illegal router from network
I have a default gateway with IP address 192.168.1.1 and MAC address 5c:77:76:6e:0d:7b. It is my only wi fi modem router from which I receive internet.
But in input nftables logs I saw another one ...
- 74
1
vote
1
answer
267
views
What chain types are supported by the nftables NETDEV family?
From the nftables Quick reference:
family refers to a one of the following table types: ip, arp, ip6,
bridge, inet, netdev.
and
type refers to the kind of chain to be created. Possible types are:
...
- 2,191
1
vote
1
answer
671
views
Porting Iptables to Nftables firewall with conntrack marks
Hi dear esteemed community,
I'm having a hard time porting my very functional iptables firewall to nftables.
No issues with input/output/forward stuffs, it's mainly the conntrack marking.
What I ...
- 13
1
vote
1
answer
76
views
blocking obsolete tcp options
On Linux, I want to drop all packets that contain any obsolete tcp options. By obsolete options, I mean all those with a tcp option kind number above 8. How can I do this using nftables?
For example, ...
- 25
1
vote
1
answer
427
views
Understanding nftables logs
What happened during these logs entry events below?
Nov* 8 09:37:12 kernel: [10967.520783] New Input packets: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.1.2 DST=192.168.1.2 ...
- 74
2
votes
1
answer
545
views
How to filter ARP-Requests with Nftables using a Raspberry Pi as AP (using hostapd)
I´m trying to filter ARP-requests coming from certain IP-addresses in my network.
I tried :
table arp filter {
chain input {
type filter hook input priority 0; policy drop;
...
0
votes
1
answer
123
views
How to use a set as a key in a (v)map?
For example, one can:
ip saddr vmap { 192.168.1.2: goto chain_a, 192.168.1.6: goto chain_b }
but apparently not:
ip saddr vmap { { 192.168.1.2, 192.168.1.4 }: goto chain_a,
{ 192.168....
- 392
0
votes
1
answer
472
views
Router with nftables doesn't work well
I have Debian 4.19.194-1 as a router server with LAN, WAN, PPPOE (as gateway) and COMPUTER1 in LAN network which should have access to internet through Debian router.
As firewall I use nftables with ...
3
votes
1
answer
427
views
nftables Error: syntax error, unexpected saddr
I wanted to add the rule arp saddr ip 192.168.2.1 counter accept to my Nftables firewall. When reading the config-file with sudo nft -f /etc/nftables2.conf, I get the error-message
/etc/nftables2.conf:...
1
vote
1
answer
226
views
Nftables not matching TOS value in IP packets
This is on Ubuntu 20.04.
I am attempting to write a rule for nftables which will match all IP packets received on interface eth1 that have a specific TOS value (0x02). My attempt so far:
sudo nft add ...
- 141
2
votes
1
answer
3k
views
nftables whitelisting docker
I have two docker containers running on my machine where a very restrictive nftables configuration is active. I'd like to keep it that way but whitelist access to the docker containers from outside.
...
- 125
0
votes
0
answers
54
views
nftables table will not permanently flush
I have a Centos 8 machine in testing where I've disabled firewalld. I'm attempting to use nftables directly.
I have a /etc/sysconfig/nftables.conf that has a table defined as I like. However there is ...
- 21
0
votes
1
answer
480
views
iptables string rules translation to nftables
I am migrating rules from iptable's to nftable's by following Moving from iptable to nftable
I now have few IPs and ports block rule in place along with a string based iptable rules but by using the ...
0
votes
1
answer
123
views
Connect to server behind NAT from LAN using real IP
I have a small network.
It has a firewall connected to the internet (WAN) with real IP and DNS name which also acts as a DHCP server
for the internal network (LAN).
On the firewall machine I've setup ...
- 293
1
vote
1
answer
131
views
An upper limit on the number of rules nftables can realistically process
I am designing a large SaaS VPN service and am planning to use nftables.
Is there a realistic limit to the number of rules it can process?
Rules will be compiled from a database. There will be ...
- 123
2
votes
1
answer
756
views
How to reset sessions in nat table?
I have two virtual machines (router and client) ubuntu server 18 04, the router is the gateway for the client.Nftables are installed on the router and a NAT table is created with two chains pre and ...
- 57
0
votes
1
answer
535
views
`nft flush ruleset` can't delete all rules permanently?
List all ruleset currently:
sudo nft list ruleset
table inet filter {
chain input {
type filter hook input priority 0; policy accept;
iif "lo" accept
}
chain ...
- 35