Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [nftables]

nftables is the successor of iptables/ip6tables and available since Linux kernel version 3.13

0
votes
1answer
6 views

Can I match a set negatively in nftables?

Let's say I want to apply a rule to ip daddr { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 }, but I want to exclude two more specific IPv4 addresses from that. How do I do that? I was hoping for some ...
0
votes
1answer
69 views

How should I deal with cyclic dependencies caused by a systemd dynamic user not existing before the service starts?

I would like for dnscrypt-proxy to run as a dynamic user instead of as root. But I would also like to use a firewall rule in nftables where I specify the user dnscrypt-proxy, to allow it to connect to ...
0
votes
1answer
742 views

Set up nftables to only allow connections through a vpn and block all ipv6 traffic

I am trying to set up a nftables firewall on my archlinux distribution that only allows traffic through a vpn (and blocks all ipv6 traffic in order to prevent any ipv6 leaks) I have been playing ...
4
votes
0answers
70 views

Multicast ICMPv6 comes back with conntrack state invalid

I was playing arround with the Multicast feature of IPv6. $ ping ff02::2%wlp3s0 This should normally result in an echo-reply from all the routers on your local network segment (Wikipedia - IPv6). So ...
2
votes
0answers
67 views

How to get a PID/name/path of a process that sends a network packet?

We have an application that sends some data over the TCP/IP network. We don't know which process that would be, but we want to target it. All we know is the following nftables log: kernel: * OUTPUT * ...
2
votes
0answers
479 views

Internet access in LXC container with nftables

I'm currently trying to give an LXC container internet access using nftables, but I don't seem to get it right whatsoever. The setup is the following: The host has a WAN interface (enp1s0) and a ...
0
votes
0answers
20 views

Keep conntrack state for current ssh connection on netfilter rule flush/reload

When i am reloading netfilter with a new ruleset that drops invalid packets flush ruleset ... ct state invalid counter log prefix "Drop input invalid " drop comment "drop invalid packets" ... over ...
0
votes
0answers
126 views

How to use wildcard in a list with nftables

I'd like to use wildcards in a list with nftables. I tried this, but it gives me an error when I'm loading it: iifname {"virbr*", "vboxnet*"} accept oifname {"virbr*", "vboxnet*"} ct state ...