Questions tagged [nftables]
nftables is the successor of iptables/ip6tables and available since Linux kernel version 3.13
47
questions
1
vote
1answer
47 views
nftables remove all rules in chain
I have a number of rules in table mytable chain mychain:
> sudo nft -a list table mytable
table ip mytable { # handle 8
chain mychain { # handle 1
type filter hook input ...
1
vote
0answers
20 views
NFTable clarification
I need some clarification. If I add this rule
nft add rule ip filter INPUT ip daddr 127.0.0.1 drop
nftables will ignore it and never acknowledge because it is on end of the rules?
0
votes
0answers
24 views
iptables CLUSTERIP and nftables
I'm trying to set up a firewall cluster to do a simple load balance and high avaibility.
On iptables I found the CLUSTERIP functionality that would seem to be right for me.
If I understand correctly ...
0
votes
1answer
94 views
nftables doesn't work even though config file exists
I'm using nftables on Debian 10.
There is my config file
# cat /etc/nftables.conf
#!/usr/sbin/nft -f
flush ruleset
table inet filter {
chain input {
type filter hook input ...
2
votes
0answers
205 views
Fail2ban & nftables errors, IPs not banned
So I've been experimenting with nftables in CentOS 8 and things are going pretty well, but I'm having a weird problem with fail2ban.
Fail2ban cannot ban IPs with nftables-multiport or nftables-...
0
votes
0answers
29 views
Update only nftables.conf firewall rules
There's base firewall config in /etc/nftables.conf. I'm also using docker and kvm+qemu. Docker and kvm+qemu generates their own firewall rules at some point. How you could only flush the ones in /etc/...
0
votes
1answer
47 views
nftables allow redis only from specific IP addresses
I am configuring a REDIS server and I want to allow connections only from a set of specific IP addresses.
This is a Debian 10 server, and the recommended framework to use is nft, which I haven't used ...
1
vote
1answer
54 views
firewall: nftable counter rules
A few months ago, I migrated the firewall of a debian laptop from iptables to nftables, using debian's recommended procedure, and all seems to have been fine. Now, months later, I'm scrutinizing the ...
2
votes
1answer
459 views
Port forwarding & NAT with nftables
I have an OpenWRT gateway (self-built 19.07, kernel 4.14.156) that sits on a public IP address in front of my private network. I am using nftables (not iptables).
I would like to expose a non-...
0
votes
0answers
51 views
'nft list ruleset' not correctly displaying rules created with iptables-nft?
I'm using nft and the iptables-nft compatability interface on two systems, one running Fedora 31 and another running Arch Linux. If I use the iptables wrapper like this:
iptables -A INPUT -p tcp --...
1
vote
0answers
29 views
nftables chains and priority problem [duplicate]
I have two output chains like this:
chain OUT {
type filter hook output priority 0; policy accept;
ct state established,related accept
oif "lo" counter packets 0 bytes 0 accept
ip ...
2
votes
1answer
738 views
CentOS 8 firewalld + nftables or just nftables
I've been on CentOS 7 for a long time and was used to building my custom iptables configurations on a variety of both personal and business boxes.
I've recently started working with CentOS 8 and ...
2
votes
1answer
53 views
How do you filter packets differently based on time of day in nftables?
I would like to e.g. block certain traffic between 00:00 and 04:00. Is this possible in nftables?
(Obviously I can just set a cron job that changes the config at these times - but I would like to ...
3
votes
2answers
145 views
Using custom tables in nft
I have a Fedora 31 system on which I am using iptables-nft. I need this because there is still a bunch of software that expects the legacy iptables command line tools. This means that my nftables ...
1
vote
1answer
63 views
nftables rules not blocking traffic
I am testing NFtables and am attempting to set up a basic routing firewall on a linux machine with 2 interfaces, ens37 and ens38. Here is the ifconfig output for these 2 interfaces.
ens37: flags=4163&...
1
vote
1answer
334 views
nftables meter error: syntax error, unexpected saddr, expecting comma or '}'
I have below nftable rule to add a connection rate meter:
nft add rule ip filter input tcp dport @rate_limit meter syn4-meter \{ ip saddr . tcp dport timeout 5m limit rate 20/minute \} counter ...
0
votes
0answers
75 views
How do I route access point traffic through a network namespace using nftables?
First I create a "vpn" network namespace and a veth pair to connect it to the internet via my "ens32" wired ethernet adapter. Then I start openvpn inside the network namespace. Everything in the "vpn" ...
1
vote
1answer
812 views
nftables rule: No such file or directory error
I am trying to apply below nftables rule which I adopted from this guide:
nft add rule filter INPUT tcp flags != syn counter drop
somehow this is ending up with:
Error: Could not process rule: No ...
1
vote
1answer
98 views
nftables: flush/delete when changing or creating new table
I have created an net-filter table. I am have it in a script, I can not get this script to always load. If I flush/delete the table, then it does not work if the table does not exist. If I do not ...
0
votes
1answer
143 views
nftables in Server is blocking SSH login (with stronger SSH key)
please help me to solve this problem:
it appears to me that nftables in Server-3 (Debian-10) is blocking SSH login (from macOS client).
Extra Note related to my below all info : Ubuntu, Kali, Tails, ...
0
votes
0answers
46 views
NFT all traffic redirection
I am trying to use nft to redirect traffic at destination ip0:port0 to 127.0.0.1:xxxx.
I tried Google it but all I got was http redirect nothing about couple ip/port
thank for you time
0
votes
1answer
218 views
nftables with openvpn and lxc
I have a simple setup involving OpenVPN server in a LXC container (debian stretch host, debian buster container), in which i'd like to set up a firewall based on nftables.
What confused me is the ...
0
votes
1answer
159 views
nftables not working, am I doing it right?
I was following tutorial at https://wiki.nftables.org/wiki-nftables/index.php/Main_Page
Here is what I did.
#uname -a
Linux delor 4.9.0-0.bpo.6-amd64 #1 SMP Debian 4.9.88-1+deb9u1~bpo8+1 (2018-05-13)...
0
votes
1answer
241 views
Can I match a set negatively in nftables?
Let's say I want to apply a rule to ip daddr { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 }, but I want to exclude two more specific IPv4 addresses from that. How do I do that?
I was hoping for some ...
1
vote
1answer
410 views
How do I create a named set of strings in nftables (for interface names)?
Using sets in nftables is really cool. I am currently using a lot of statements like these in my nftables.conf rulesets:
iifname {clients0, dockernet} oifname wan0 accept comment "Allow clients and ...
2
votes
2answers
1k views
How to prevent iptables and nftables rules from running simultaneously?
I'm trying to set up a firewall on my own desktop (currently I'm tinkering with a Fedora 29 virtual machine). I would like to have it on the "deny-everything-by-default" basis. Almost immediately I ...
0
votes
0answers
46 views
Keep conntrack state for current ssh connection on netfilter rule flush/reload
When i am reloading netfilter with a new ruleset that drops invalid packets
flush ruleset
...
ct state invalid counter log prefix "Drop input invalid " drop comment "drop invalid packets"
...
over ...
3
votes
1answer
1k views
ip6table-restore failed in Debian buster/sid
I have the below iptable rule in /etc/iptables/rule.V6 and /etc/iptables/rule.V4
-4 -A INPUT -p icmp -j ACCEPT
-6 -A INPUT -p ipv6-icmp -j ACCEPT
when I tried to restart the netfilter-persistent, it ...
0
votes
1answer
482 views
How can I configure bidirectional protocol-independent port forwarding?
I am attempting to solve the following problem:
I have a system which I will henceforth refer to as "Local" that hosts a service on port 80 and port 443, and depends on sending outgoing requests on ...
1
vote
1answer
737 views
Nftables rules dissapiered after reboot!
I tried this:
iptables -F
ip6tables -F
sudo nft list ruleset > /etc/nftables.conf
sudo service netfilter-persistent save
But after reboot when i run
nft list ruleset
i see nothing. I think ...
2
votes
0answers
175 views
How to get a PID/name/path of a process that sends a network packet?
We have an application that sends some data over the TCP/IP network. We don't know which process that would be, but we want to target it. All we know is the following nftables log:
kernel: * OUTPUT * ...
5
votes
0answers
150 views
Multicast ICMPv6 comes back with conntrack state invalid
I was playing arround with the Multicast feature of IPv6.
$ ping ff02::2%wlp3s0
This should normally result in an echo-reply from all the routers on your local network segment (Wikipedia - IPv6).
So ...
0
votes
1answer
60 views
What do the letters 'BLA' refer to in `man nft`?
man nft has this section:
Do the letters B-L-A stand for something? (I've already ruled out Bla Bla.)
GNU/Linux Debian Stretch 9.6
7
votes
0answers
766 views
What is the difference between NFTables and BPFilter? [closed]
I trying to secure my home network with OpenWRT routers. In this context I started to customize my iptables rules to my needs and found some iptables concepts hard to understand.
I've discovered ...
2
votes
2answers
504 views
nftables / iptables rules to rewrite source IP by interface
I have a physical network with a Linux server (Ubuntu 16.04, kernel 4.13) and several gadgets on it. Each gadget has the same unchangeable static IP, e.g. 192.168.0.222/24. I would like to ...
1
vote
1answer
736 views
Is it possible to filter/drop packets by MAC using nftables
I have two systems that are connected over Ethernet and one system has a WiFi radio which provides internet access.
In this diagram sys#2 has the WiFi radio
sys#1 <---> Ethernet <---> ...
2
votes
1answer
2k views
How to match both UDP and TCP for given ports in one line with nftables
How can i do this in a single line?
tcp dport 53 counter accept comment "accept DNS"
udp dport 53 counter accept comment "accept DNS"
0
votes
1answer
542 views
nftables, add output rule syntax
I'm a bit frustrated by the lack of comprehensive documentation of nftables and currently I'm failing to get even a simple example to work. I'm trying just create a output rule. Here's my only table:
...
3
votes
1answer
2k views
When and how to use chain priorities in nftables
When configuring a chain in nftables, one has to provide a priority value. Almost all online examples set a piority of 0; sometimes, a value of 100 gets used with certain hooks (output, postrouting).
...
0
votes
1answer
93 views
How should I deal with cyclic dependencies caused by a systemd dynamic user not existing before the service starts?
I would like for dnscrypt-proxy to run as a dynamic user instead of as root. But I would also like to use a firewall rule in nftables where I specify the user dnscrypt-proxy, to allow it to connect to ...
2
votes
0answers
701 views
Internet access in LXC container with nftables
I'm currently trying to give an LXC container internet access using nftables, but I don't seem to get it right whatsoever.
The setup is the following:
The host has a WAN interface (enp1s0) and a ...
2
votes
1answer
712 views
Nftables configuration error: conflicting protocols specified: inet-service v. icmp
I am trying to build a simple stateful firewall with nftables following the Arch Linux nftables guide. I posted this question on the Arch Linux forum and never received an answer.
After completing ...
1
vote
1answer
599 views
Logging SSH public key connection attempts with nftables [closed]
Question
What is the best way to set up logging SSH attempts with SSH public-key authentication and nftables? Also, what is the best way to test this?
I'd like to do this without installing a ...
1
vote
2answers
3k views
Using Linux as router with nftables - masquerade not forwarding reply back
I have a Linux machine which I'm using as a router. It has 5 network interfaces: three separate LANs which it routes between, and two WANs. At the moment I just have one WAN as the default route, and ...
2
votes
1answer
1k views
Set up nftables to only allow connections through a vpn and block all ipv6 traffic
I am trying to set up a nftables firewall on my archlinux distribution that only allows traffic through a vpn (and blocks all ipv6 traffic in order to prevent any ipv6 leaks)
I have been playing ...
4
votes
1answer
2k views
nftables ip set multiple tables
Use case: I have a home router using iptables today. I'm researching converting over to nftables, as it looks to be much more manageable for a lot of rules.
One thing I have setup today under ...
0
votes
2answers
5k views
How to do Masquerading with NFTables
How would I implement a masquerading rule like this iptables one in NFTables:
iptables -t nat -A POSTROUTING -s 10.5.6.0/24 -o eth0 -j MASQUERADE
I've looked for it, but couldn't find out how to set ...
