Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [nftables]

nftables is the successor of iptables/ip6tables and available since Linux kernel version 3.13

0
votes
1answer
8 views

Can I match a set negatively in nftables?

Let's say I want to apply a rule to ip daddr { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 }, but I want to exclude two more specific IPv4 addresses from that. How do I do that? I was hoping for some ...
1
vote
1answer
25 views

How do I create a named set of strings in nftables (for interface names)?

Using sets in nftables is really cool. I am currently using a lot of statements like these in my nftables.conf rulesets: iifname {clients0, dockernet} oifname wan0 accept comment "Allow clients and ...
1
vote
1answer
70 views

How to prevent iptables and nftables rules from running simultaneously?

I'm trying to set up a firewall on my own desktop (currently I'm tinkering with a Fedora 29 virtual machine). I would like to have it on the "deny-everything-by-default" basis. Almost immediately I ...
0
votes
0answers
20 views

Keep conntrack state for current ssh connection on netfilter rule flush/reload

When i am reloading netfilter with a new ruleset that drops invalid packets flush ruleset ... ct state invalid counter log prefix "Drop input invalid " drop comment "drop invalid packets" ... over ...
3
votes
1answer
96 views

ip6table-restore failed in Debian buster/sid

I have the below iptable rule in /etc/iptables/rule.V6 and /etc/iptables/rule.V4 -4 -A INPUT -p icmp -j ACCEPT -6 -A INPUT -p ipv6-icmp -j ACCEPT when I tried to restart the netfilter-persistent, it ...
0
votes
1answer
53 views

How can I configure bidirectional protocol-independent port forwarding?

I am attempting to solve the following problem: I have a system which I will henceforth refer to as "Local" that hosts a service on port 80 and port 443, and depends on sending outgoing requests on ...
1
vote
1answer
143 views

Nftables rules dissapiered after reboot!

I tried this: iptables -F ip6tables -F sudo nft list ruleset > /etc/nftables.conf sudo service netfilter-persistent save But after reboot when i run nft list ruleset i see nothing. I think ...
2
votes
0answers
67 views

How to get a PID/name/path of a process that sends a network packet?

We have an application that sends some data over the TCP/IP network. We don't know which process that would be, but we want to target it. All we know is the following nftables log: kernel: * OUTPUT * ...
4
votes
0answers
74 views

Multicast ICMPv6 comes back with conntrack state invalid

I was playing arround with the Multicast feature of IPv6. $ ping ff02::2%wlp3s0 This should normally result in an echo-reply from all the routers on your local network segment (Wikipedia - IPv6). So ...
0
votes
1answer
44 views

What do the letters 'BLA' refer to in `man nft`?

man nft has this section: Do the letters B-L-A stand for something? (I've already ruled out Bla Bla.) GNU/Linux Debian Stretch 9.6
6
votes
0answers
493 views

What is the difference between NFTables and BPFilter? [closed]

I trying to secure my home network with OpenWRT routers. In this context I started to customize my iptables rules to my needs and found some iptables concepts hard to understand. I've discovered ...
2
votes
2answers
239 views

nftables / iptables rules to rewrite source IP by interface

I have a physical network with a Linux server (Ubuntu 16.04, kernel 4.13) and several gadgets on it. Each gadget has the same unchangeable static IP, e.g. 192.168.0.222/24. I would like to ...
1
vote
1answer
342 views

Is it possible to filter/drop packets by MAC using nftables

I have two systems that are connected over Ethernet and one system has a WiFi radio which provides internet access. In this diagram sys#2 has the WiFi radio sys#1 <---> Ethernet <---> ...
1
vote
1answer
548 views

How to match both UDP and TCP for given ports in one line with nftables

How can i do this in a single line? tcp dport 53 counter accept comment "accept DNS" udp dport 53 counter accept comment "accept DNS"
0
votes
0answers
129 views

How to use wildcard in a list with nftables

I'd like to use wildcards in a list with nftables. I tried this, but it gives me an error when I'm loading it: iifname {"virbr*", "vboxnet*"} accept oifname {"virbr*", "vboxnet*"} ct state ...
0
votes
1answer
343 views

nftables, add output rule syntax

I'm a bit frustrated by the lack of comprehensive documentation of nftables and currently I'm failing to get even a simple example to work. I'm trying just create a output rule. Here's my only table: ...
0
votes
1answer
731 views

When and how to use chain priorities in nftables

When configuring a chain in nftables, one has to provide a priority value. Almost all online examples set a piority of 0; sometimes, a value of 100 gets used with certain hooks (output, postrouting). ...
0
votes
1answer
71 views

How should I deal with cyclic dependencies caused by a systemd dynamic user not existing before the service starts?

I would like for dnscrypt-proxy to run as a dynamic user instead of as root. But I would also like to use a firewall rule in nftables where I specify the user dnscrypt-proxy, to allow it to connect to ...
2
votes
0answers
481 views

Internet access in LXC container with nftables

I'm currently trying to give an LXC container internet access using nftables, but I don't seem to get it right whatsoever. The setup is the following: The host has a WAN interface (enp1s0) and a ...
1
vote
1answer
374 views

Nftables configuration error: conflicting protocols specified: inet-service v. icmp

I am trying to build a simple stateful firewall with nftables following the Arch Linux nftables guide. I posted this question on the Arch Linux forum and never received an answer. After completing ...
1
vote
1answer
358 views

Logging SSH public key connection attempts with nftables [closed]

Question What is the best way to set up logging SSH attempts with SSH public-key authentication and nftables? Also, what is the best way to test this? I'd like to do this without installing a ...
1
vote
2answers
2k views

Using Linux as router with nftables - masquerade not forwarding reply back

I have a Linux machine which I'm using as a router. It has 5 network interfaces: three separate LANs which it routes between, and two WANs. At the moment I just have one WAN as the default route, and ...
0
votes
1answer
750 views

Set up nftables to only allow connections through a vpn and block all ipv6 traffic

I am trying to set up a nftables firewall on my archlinux distribution that only allows traffic through a vpn (and blocks all ipv6 traffic in order to prevent any ipv6 leaks) I have been playing ...
4
votes
1answer
1k views

nftables ip set multiple tables

Use case: I have a home router using iptables today. I'm researching converting over to nftables, as it looks to be much more manageable for a lot of rules. One thing I have setup today under ...
0
votes
2answers
3k views

How to do Masquerading with NFTables

How would I implement a masquerading rule like this iptables one in NFTables: iptables -t nat -A POSTROUTING -s 10.5.6.0/24 -o eth0 -j MASQUERADE I've looked for it, but couldn't find out how to set ...