Skip to main content
32 votes
Accepted

nftables whitelisting docker

While the problem might appear simple, it's nothing but. Having Docker around always imposes several challenges to other parts in the system dealing with networking. Once nftables gets more widely ...
A.B's user avatar
  • 37.2k
24 votes

How to protect against port scanners?

Simple rate limit is not enough because nmap increases scan delay when it hits rate limit. Here is what you can do best with iptables. First create ipset lists ipset create port_scanners hash:ip ...
ibrahim's user avatar
  • 1,087
18 votes
Accepted

When and how to use chain priorities in nftables

UPDATE: iptables-nft (rather than iptables-legacy) is using the nftables kernel API and in addition a compatibility layer to reuse xtables kernel modules (those described in iptables-extensions) when ...
A.B's user avatar
  • 37.2k
18 votes
Accepted

Can nftables and iptables/ip6tables rules be applied at the same time? If so: what's the order of precedence?

It is possible to use the kernel’s iptables and nftables simultaneously, but it requires some attention. The order in which the rules are applied is determined by the hook priority; legacy iptables ...
Stephen Kitt's user avatar
16 votes
Accepted

nftables remove all rules in chain

There are still some errors lurking in the nftables wiki. The actual syntax is quite logical: to remove everything nft flush ruleset to empty a table (with ip as family by default if not specified)....
A.B's user avatar
  • 37.2k
15 votes
Accepted

Packet processing order in nftables

The ordering in the example will be undefined, but both chains will be traversed (unless for example the packet gets dropped in the first chain seen). Netfilter and the Network/Routing stack provide ...
A.B's user avatar
  • 37.2k
14 votes
Accepted

nftables ip set multiple tables

I received a response from the nftables developers after asking on their mail list. The short answer is that referencing sets in another table is not possible. However, I was at least able to store ...
Mark's user avatar
  • 765
13 votes
Accepted

nftables rule: No such file or directory error

You're probably missing your table or chain. nft list ruleset will give you what you are working with. If it prints out nothing, you're missing both. nft add table ip filter # create table nft add ...
Vivian's user avatar
  • 431
12 votes
Accepted

What is the relationship or difference among iptables, xtables, iptables-nft, xtables-nft, nf_tables, nftables

My view is that iptables, ip6tables, ebtables and arptable is a frontend tool-set to Netfilter. They are a user-space tool-set that format and compile the rules to load them in the core Netfilter that ...
dominix's user avatar
  • 675
11 votes
Accepted

How to match both UDP and TCP for given ports in one line with nftables

With a recent enough nftables, you can just write: meta l4proto {tcp, udp} th dport 53 counter accept comment "accept DNS" Actually, you can do even better: set okports { type inet_proto ....
Totor's user avatar
  • 20.3k
11 votes
Accepted

CentOS 8 firewalld + nftables or just nftables

I think the answer is fairly straightforward. First, you have done exactly the right thing... Firewalld is a pure frontend. It's not an independent firewall by itself. It only operates by taking ...
henrystrick's user avatar
10 votes

How to do Masquerading with NFTables

as an aside, if you were masquerading under a dynamic address, you could simply add rule nat postrouting oif ppp0 masquerade oif / oifname Userspace converts oif to integer at runtime You should use ...
Andrew Siplas's user avatar
10 votes

How to do Masquerading with NFTables

You can write the rule this way: nft add rule nat postrouting ip saddr 10.5.6.0/24 oif eth0 masquerade Take a look on nftables nat wiki for more informations.
setenforce 1's user avatar
10 votes
Accepted

Create dynamic blacklist with nftables

The hydra tool connects concurrently multiple times to the SSH server. In OP's case (comment: hydra -l <username> -P </path/to/passwordlist.txt> -I -t 6 ssh://<ip-address>) it will ...
A.B's user avatar
  • 37.2k
9 votes
Accepted

nftables: flush/delete when changing or creating new table

First declare an empty table. If the table already existed, it doesn't throw an error nor alter its content: nothing happens. If it didn't exist, the empty table was just created. Now that it exists ...
A.B's user avatar
  • 37.2k
9 votes

How to protect against port scanners?

If you want a service (such as SSH) to be available and able to be used, then Nmap will be able to find it. Generally speaking, port scans are not a threat; your security should not depend on an ...
bonsaiviking's user avatar
  • 2,717
9 votes
Accepted

How to properly log and view nftables activity?

You can use nftrace to trace packet flows. It's very verbose but doesn't go to kernel logs but instead is distributed over multicast netlink socket (ie if nothing listens to them, traces just go to &...
A.B's user avatar
  • 37.2k
8 votes
Accepted

Check whether iptables or nftables are in use

A variant of this problem was addressed recently in Kubernetes, so it’s worth looking at what was done there. (The variant is whether to use iptables-legacy or iptables-nft and their IPv6 variants to ...
Stephen Kitt's user avatar
8 votes
Accepted

How to list all ports and service with nftables?

Here's my nftables cheat sheet: Load rules: nft -f /etc/sysconfig/nftables.conf (this will append them to the existing ones, so flushing first might be required) Watch rules: nft list ruleset Reset ...
Artem S. Tashkinov's user avatar
7 votes
Accepted

How do I replace nftables rules atomically?

The operation done with nft -f /path/to/new/rules is atomic: that means it's either done completely or not done at all (ie: reverted), and will affect all at once the next packet hitting the rules ...
A.B's user avatar
  • 37.2k
7 votes

Correct way to switch back to iptables on debian 10 or 11

It is documented on Debian Wiki: update-alternatives --set iptables /usr/sbin/iptables-legacy update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy update-alternatives --set arptables /usr/...
GAD3R's user avatar
  • 67.4k
6 votes
Accepted

ip6table-restore failed in Debian buster/sid

You are most certainly running iptables over nftables, as this is the default on Debian buster. To confirm this is the case, check for (nf_tables): # ip6tables-restore --version ip6tables-restore v1....
A.B's user avatar
  • 37.2k
6 votes
Accepted

Port forwarding & NAT with nftables

You are not translating the port number. When the external connection is to port 1234, this is not a problem. But when it is to 4321, the dnat passes through to port 4321 on the internal server, not ...
Steve Brandli's user avatar
6 votes
Accepted

nftables: duplicate broadcast packets between segments

It's still possible to use nftables in the netdev family (rather than ip family) for this case, since only ingress is needed (nftables still doesn't have egress available). The behaviour of dup and ...
A.B's user avatar
  • 37.2k
6 votes
Accepted

Port forwarding not working with "policy drop"

Your current setup doesn't work simply because forwarding is disabled, despite: # sysctl net.ipv4.ip_forward net.ipv4.ip_forward = 1 because of the type filter hook forward chain set to policy drop:...
A.B's user avatar
  • 37.2k
6 votes
Accepted

Delete illegal router from network

Routers often have multiple virtual network interfaces, and the MAC address that gets assigned to these is made by flipping some bits of the hardware MAC address. So the "illegal router" you ...
dirkt's user avatar
  • 32.6k
5 votes
Accepted

Is it possible to filter/drop packets by MAC using nftables

Using nft, to drop all ethernet frames which are received from network interface eth0 and do not have source address of 00:00:5e:00:53:00: nft add rule filter input iif eth0 ether saddr != 00:00:5e:...
sebasth's user avatar
  • 15.1k
5 votes
Accepted

Can I match a set negatively in nftables?

It appears that negations of sets are working as expected (undocumented): ip daddr { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 } \ ip daddr != { 10.0.1.2, 10.0.2.3 }
gertvdijk's user avatar
  • 14k
5 votes

How to protect against port scanners?

Here is what nmap's documentation says about the "filtered" state: The state is either open, filtered, closed, or unfiltered. Open means that an application on the target machine is listening for ...
dhag's user avatar
  • 15.9k
5 votes

Nftables management problem

OP uses this kind of rules, that's the layout I'll use as example to base the answer upon: add rule ip nat postrouting oifname $inet_if ip saddr 172.xx.xx.xx counter snat to $inet_if_ip add rule ip ...
A.B's user avatar
  • 37.2k

Only top scored, non community-wiki answers of a minimum length are eligible