Questions tagged [nftables]

nftables is the successor of iptables/ip6tables and available since Linux kernel version 3.13

Filter by
Sorted by
Tagged with
0
votes
0answers
19 views

How to make nftables duplicate multiple interfaces to one interface

My home router has 2 internal interfaces on different subnets, and one external interface plugged into the comcast modem. I'd like to duplicate every packet that enters each interface out to a single ...
0
votes
0answers
28 views

Nftables conflicting tables: Include multiple *.nft only loads first inet table?

Configuration: /etc/sysconfig/nftables.conf contains an include: "include /etc/nftables/my-filter*.nft" /etc/nftables contains my-filter1.nft with "table inet default {" my-filter2.nft with "table ...
1
vote
1answer
83 views

nftables remove all rules in chain

I have a number of rules in table mytable chain mychain: > sudo nft -a list table mytable table ip mytable { # handle 8 chain mychain { # handle 1 type filter hook input ...
1
vote
0answers
22 views

NFTable clarification

I need some clarification. If I add this rule nft add rule ip filter INPUT ip daddr 127.0.0.1 drop nftables will ignore it and never acknowledge because it is on end of the rules?
0
votes
0answers
36 views

iptables CLUSTERIP and nftables

I'm trying to set up a firewall cluster to do a simple load balance and high avaibility. On iptables I found the CLUSTERIP functionality that would seem to be right for me. If I understand correctly ...
0
votes
1answer
198 views

nftables doesn't work even though config file exists

I'm using nftables on Debian 10. There is my config file # cat /etc/nftables.conf #!/usr/sbin/nft -f flush ruleset table inet filter { chain input { type filter hook input ...
2
votes
0answers
358 views

Fail2ban & nftables errors, IPs not banned

So I've been experimenting with nftables in CentOS 8 and things are going pretty well, but I'm having a weird problem with fail2ban. Fail2ban cannot ban IPs with nftables-multiport or nftables-...
0
votes
0answers
40 views

Update only nftables.conf firewall rules

There's base firewall config in /etc/nftables.conf. I'm also using docker and kvm+qemu. Docker and kvm+qemu generates their own firewall rules at some point. How you could only flush the ones in /etc/...
0
votes
1answer
104 views

nftables allow redis only from specific IP addresses

I am configuring a REDIS server and I want to allow connections only from a set of specific IP addresses. This is a Debian 10 server, and the recommended framework to use is nft, which I haven't used ...
1
vote
1answer
119 views

firewall: nftable counter rules

A few months ago, I migrated the firewall of a debian laptop from iptables to nftables, using debian's recommended procedure, and all seems to have been fine. Now, months later, I'm scrutinizing the ...
2
votes
1answer
836 views

Port forwarding & NAT with nftables

I have an OpenWRT gateway (self-built 19.07, kernel 4.14.156) that sits on a public IP address in front of my private network. I am using nftables (not iptables). I would like to expose a non-...
0
votes
0answers
88 views

'nft list ruleset' not correctly displaying rules created with iptables-nft?

I'm using nft and the iptables-nft compatability interface on two systems, one running Fedora 31 and another running Arch Linux. If I use the iptables wrapper like this: iptables -A INPUT -p tcp --...
1
vote
0answers
30 views

nftables chains and priority problem [duplicate]

I have two output chains like this: chain OUT { type filter hook output priority 0; policy accept; ct state established,related accept oif "lo" counter packets 0 bytes 0 accept ip ...
3
votes
1answer
1k views

CentOS 8 firewalld + nftables or just nftables

I've been on CentOS 7 for a long time and was used to building my custom iptables configurations on a variety of both personal and business boxes. I've recently started working with CentOS 8 and ...
2
votes
1answer
63 views

How do you filter packets differently based on time of day in nftables?

I would like to e.g. block certain traffic between 00:00 and 04:00. Is this possible in nftables? (Obviously I can just set a cron job that changes the config at these times - but I would like to ...
3
votes
2answers
201 views

Using custom tables in nft

I have a Fedora 31 system on which I am using iptables-nft. I need this because there is still a bunch of software that expects the legacy iptables command line tools. This means that my nftables ...
1
vote
1answer
71 views

nftables rules not blocking traffic

I am testing NFtables and am attempting to set up a basic routing firewall on a linux machine with 2 interfaces, ens37 and ens38. Here is the ifconfig output for these 2 interfaces. ens37: flags=4163&...
1
vote
1answer
413 views

nftables meter error: syntax error, unexpected saddr, expecting comma or '}'

I have below nftable rule to add a connection rate meter: nft add rule ip filter input tcp dport @rate_limit meter syn4-meter \{ ip saddr . tcp dport timeout 5m limit rate 20/minute \} counter ...
0
votes
0answers
86 views

How do I route access point traffic through a network namespace using nftables?

First I create a "vpn" network namespace and a veth pair to connect it to the internet via my "ens32" wired ethernet adapter. Then I start openvpn inside the network namespace. Everything in the "vpn" ...
1
vote
1answer
1k views

nftables rule: No such file or directory error

I am trying to apply below nftables rule which I adopted from this guide: nft add rule filter INPUT tcp flags != syn counter drop somehow this is ending up with: Error: Could not process rule: No ...
1
vote
1answer
140 views

nftables: flush/delete when changing or creating new table

I have created an net-filter table. I am have it in a script, I can not get this script to always load. If I flush/delete the table, then it does not work if the table does not exist. If I do not ...
0
votes
1answer
163 views

nftables in Server is blocking SSH login (with stronger SSH key)

please help me to solve this problem: it appears to me that nftables in Server-3 (Debian-10) is blocking SSH login (from macOS client). Extra Note related to my below all info : Ubuntu, Kali, Tails, ...
0
votes
0answers
48 views

NFT all traffic redirection

I am trying to use nft to redirect traffic at destination ip0:port0 to 127.0.0.1:xxxx. I tried Google it but all I got was http redirect nothing about couple ip/port thank for you time
0
votes
1answer
261 views

nftables with openvpn and lxc

I have a simple setup involving OpenVPN server in a LXC container (debian stretch host, debian buster container), in which i'd like to set up a firewall based on nftables. What confused me is the ...
0
votes
1answer
194 views

nftables not working, am I doing it right?

I was following tutorial at https://wiki.nftables.org/wiki-nftables/index.php/Main_Page Here is what I did. #uname -a Linux delor 4.9.0-0.bpo.6-amd64 #1 SMP Debian 4.9.88-1+deb9u1~bpo8+1 (2018-05-13)...
0
votes
1answer
303 views

Can I match a set negatively in nftables?

Let's say I want to apply a rule to ip daddr { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 }, but I want to exclude two more specific IPv4 addresses from that. How do I do that? I was hoping for some ...
1
vote
1answer
465 views

How do I create a named set of strings in nftables (for interface names)?

Using sets in nftables is really cool. I am currently using a lot of statements like these in my nftables.conf rulesets: iifname {clients0, dockernet} oifname wan0 accept comment "Allow clients and ...
2
votes
2answers
1k views

How to prevent iptables and nftables rules from running simultaneously?

I'm trying to set up a firewall on my own desktop (currently I'm tinkering with a Fedora 29 virtual machine). I would like to have it on the "deny-everything-by-default" basis. Almost immediately I ...
3
votes
1answer
1k views

ip6table-restore failed in Debian buster/sid

I have the below iptable rule in /etc/iptables/rule.V6 and /etc/iptables/rule.V4 -4 -A INPUT -p icmp -j ACCEPT -6 -A INPUT -p ipv6-icmp -j ACCEPT when I tried to restart the netfilter-persistent, it ...
0
votes
1answer
561 views

How can I configure bidirectional protocol-independent port forwarding?

I am attempting to solve the following problem: I have a system which I will henceforth refer to as "Local" that hosts a service on port 80 and port 443, and depends on sending outgoing requests on ...
1
vote
1answer
806 views

Nftables rules dissapiered after reboot!

I tried this: iptables -F ip6tables -F sudo nft list ruleset > /etc/nftables.conf sudo service netfilter-persistent save But after reboot when i run nft list ruleset i see nothing. I think ...
2
votes
0answers
197 views

How to get a PID/name/path of a process that sends a network packet?

We have an application that sends some data over the TCP/IP network. We don't know which process that would be, but we want to target it. All we know is the following nftables log: kernel: * OUTPUT * ...
5
votes
0answers
162 views

Multicast ICMPv6 comes back with conntrack state invalid

I was playing arround with the Multicast feature of IPv6. $ ping ff02::2%wlp3s0 This should normally result in an echo-reply from all the routers on your local network segment (Wikipedia - IPv6). So ...
0
votes
1answer
64 views

What do the letters 'BLA' refer to in `man nft`?

man nft has this section: Do the letters B-L-A stand for something? (I've already ruled out Bla Bla.) GNU/Linux Debian Stretch 9.6
6
votes
0answers
794 views

What is the difference between NFTables and BPFilter? [closed]

I trying to secure my home network with OpenWRT routers. In this context I started to customize my iptables rules to my needs and found some iptables concepts hard to understand. I've discovered ...
2
votes
2answers
552 views

nftables / iptables rules to rewrite source IP by interface

I have a physical network with a Linux server (Ubuntu 16.04, kernel 4.13) and several gadgets on it. Each gadget has the same unchangeable static IP, e.g. 192.168.0.222/24. I would like to ...
1
vote
1answer
823 views

Is it possible to filter/drop packets by MAC using nftables

I have two systems that are connected over Ethernet and one system has a WiFi radio which provides internet access. In this diagram sys#2 has the WiFi radio sys#1 <---> Ethernet <---> ...
3
votes
1answer
2k views

How to match both UDP and TCP for given ports in one line with nftables

How can i do this in a single line? tcp dport 53 counter accept comment "accept DNS" udp dport 53 counter accept comment "accept DNS"
0
votes
1answer
564 views

nftables, add output rule syntax

I'm a bit frustrated by the lack of comprehensive documentation of nftables and currently I'm failing to get even a simple example to work. I'm trying just create a output rule. Here's my only table: ...
3
votes
1answer
2k views

When and how to use chain priorities in nftables

When configuring a chain in nftables, one has to provide a priority value. Almost all online examples set a piority of 0; sometimes, a value of 100 gets used with certain hooks (output, postrouting). ...
0
votes
1answer
97 views

How should I deal with cyclic dependencies caused by a systemd dynamic user not existing before the service starts?

I would like for dnscrypt-proxy to run as a dynamic user instead of as root. But I would also like to use a firewall rule in nftables where I specify the user dnscrypt-proxy, to allow it to connect to ...
2
votes
0answers
729 views

Internet access in LXC container with nftables

I'm currently trying to give an LXC container internet access using nftables, but I don't seem to get it right whatsoever. The setup is the following: The host has a WAN interface (enp1s0) and a ...
2
votes
1answer
739 views

Nftables configuration error: conflicting protocols specified: inet-service v. icmp

I am trying to build a simple stateful firewall with nftables following the Arch Linux nftables guide. I posted this question on the Arch Linux forum and never received an answer. After completing ...
1
vote
1answer
625 views

Logging SSH public key connection attempts with nftables [closed]

Question What is the best way to set up logging SSH attempts with SSH public-key authentication and nftables? Also, what is the best way to test this? I'd like to do this without installing a ...
1
vote
2answers
3k views

Using Linux as router with nftables - masquerade not forwarding reply back

I have a Linux machine which I'm using as a router. It has 5 network interfaces: three separate LANs which it routes between, and two WANs. At the moment I just have one WAN as the default route, and ...
2
votes
1answer
1k views

Set up nftables to only allow connections through a vpn and block all ipv6 traffic

I am trying to set up a nftables firewall on my archlinux distribution that only allows traffic through a vpn (and blocks all ipv6 traffic in order to prevent any ipv6 leaks) I have been playing ...
5
votes
1answer
2k views

nftables ip set multiple tables

Use case: I have a home router using iptables today. I'm researching converting over to nftables, as it looks to be much more manageable for a lot of rules. One thing I have setup today under ...
0
votes
2answers
5k views

How to do Masquerading with NFTables

How would I implement a masquerading rule like this iptables one in NFTables: iptables -t nat -A POSTROUTING -s 10.5.6.0/24 -o eth0 -j MASQUERADE I've looked for it, but couldn't find out how to set ...