32
votes
Accepted
nftables whitelisting docker
While the problem might appear simple, it's nothing but. Having Docker around always imposes several challenges to other parts in the system dealing with networking. Once nftables gets more widely ...
- 33.3k
18
votes
Accepted
Can nftables and iptables/ip6tables rules be applied at the same time? If so: what's the order of precedence?
It is possible to use the kernel’s iptables and nftables simultaneously, but it requires some attention. The order in which the rules are applied is determined by the hook priority; legacy iptables ...
- 423k
17
votes
Accepted
When and how to use chain priorities in nftables
UPDATE: iptables-nft (rather than iptables-legacy) is using the nftables kernel API and in addition a compatibility layer to reuse xtables kernel modules (those described in iptables-extensions) when ...
- 33.3k
16
votes
Accepted
nftables remove all rules in chain
There are still some errors lurking in the nftables wiki. The actual syntax is quite logical:
to remove everything
nft flush ruleset
to empty a table (with ip as family by default if not specified)....
- 33.3k
13
votes
Accepted
nftables rule: No such file or directory error
You're probably missing your table or chain.
nft list ruleset
will give you what you are working with. If it prints out nothing, you're missing both.
nft add table ip filter # create table
nft add ...
- 431
12
votes
Accepted
nftables ip set multiple tables
I received a response from the nftables developers after asking on their mail list. The short answer is that referencing sets in another table is not possible.
However, I was at least able to store ...
- 735
12
votes
Accepted
Packet processing order in nftables
The ordering in the example will be undefined, but both chains will be traversed (unless for example the packet gets dropped in the first chain seen).
Netfilter and the Network/Routing stack provide ...
- 33.3k
11
votes
Accepted
CentOS 8 firewalld + nftables or just nftables
I think the answer is fairly straightforward. First, you have done exactly the right thing...
Firewalld is a pure frontend. It's not an independent firewall by itself. It only operates by taking ...
- 136
10
votes
How to do Masquerading with NFTables
You can write the rule this way:
nft add rule nat postrouting ip saddr 10.5.6.0/24 oif eth0 masquerade
Take a look on nftables nat wiki for more informations.
- 488
10
votes
Accepted
How to match both UDP and TCP for given ports in one line with nftables
With a recent enough nftables, you can just write:
meta l4proto {tcp, udp} th dport 53 counter accept comment "accept DNS"
Actually, you can do even better:
set okports {
type inet_proto ....
- 19.6k
10
votes
Accepted
What is the relationship or difference among iptables, xtables, iptables-nft, xtables-nft, nf_tables, nftables
My view is that iptables, ip6tables, ebtables and arptable is a frontend tool-set to Netfilter.
They are a user-space tool-set that format and compile the rules to load them in the core Netfilter that ...
- 574
9
votes
How to do Masquerading with NFTables
as an aside, if you were masquerading under a dynamic address, you could simply
add rule nat postrouting oif ppp0 masquerade
oif / oifname
Userspace converts oif to integer at runtime
You should use ...
- 434
9
votes
Accepted
Create dynamic blacklist with nftables
The hydra tool connects concurrently multiple times to the SSH server. In OP's case (comment: hydra -l <username> -P </path/to/passwordlist.txt> -I -t 6 ssh://<ip-address>) it will ...
- 33.3k
7
votes
Accepted
Check whether iptables or nftables are in use
A variant of this problem was addressed recently in Kubernetes, so it’s worth looking at what was done there. (The variant is whether to use iptables-legacy or iptables-nft and their IPv6 variants to ...
- 423k
6
votes
Accepted
nftables: flush/delete when changing or creating new table
First declare an empty table. If the table already existed, it doesn't throw an error nor alter its content: nothing happens. If it didn't exist, the empty table was just created. Now that it exists ...
- 33.3k
6
votes
Accepted
ip6table-restore failed in Debian buster/sid
You are most certainly running iptables over nftables, as this is the default on Debian buster. To confirm this is the case, check for (nf_tables):
# ip6tables-restore --version
ip6tables-restore v1....
- 33.3k
6
votes
Accepted
Port forwarding & NAT with nftables
You are not translating the port number. When the external connection is to port 1234, this is not a problem. But when it is to 4321, the dnat passes through to port 4321 on the internal server, not ...
- 211
6
votes
Accepted
How to list all ports and service with nftables?
Here's my nftables cheat sheet:
Load rules: nft -f /etc/sysconfig/nftables.conf (this will append them to the existing ones, so flushing first might be required)
Watch rules: nft list ruleset
Reset ...
- 27.2k
6
votes
Accepted
Delete illegal router from network
Routers often have multiple virtual network interfaces, and the MAC address that gets assigned to these is made by flipping some bits of the hardware MAC address.
So the "illegal router" you ...
- 31.9k
6
votes
Correct way to switch back to iptables on debian 10 or 11
It is documented on Debian Wiki:
update-alternatives --set iptables /usr/sbin/iptables-legacy
update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
update-alternatives --set arptables /usr/...
- 64.3k
5
votes
Accepted
How do I replace nftables rules atomically?
The operation done with nft -f /path/to/new/rules is atomic: that means it's either done completely or not done at all (ie: reverted), and will affect all at once the next packet hitting the rules ...
- 33.3k
5
votes
Accepted
nftables: duplicate broadcast packets between segments
It's still possible to use nftables in the netdev family (rather than ip family) for this case, since only ingress is needed (nftables still doesn't have egress available). The behaviour of dup and ...
- 33.3k
5
votes
Nftables management problem
OP uses this kind of rules, that's the layout I'll use as example to base the answer upon:
add rule ip nat postrouting oifname $inet_if ip saddr 172.xx.xx.xx counter snat to $inet_if_ip
add rule ip ...
- 33.3k
5
votes
Accepted
How to properly log and view nftables activity?
You can use nftrace to trace packet flows. It's very verbose but doesn't go to kernel logs but instead is distributed over multicast netlink socket (ie if nothing listens to them, traces just go to &...
- 33.3k
5
votes
Accepted
NFTables - How to set up simple ip and port forwarding?
Your current setup doesn't work simply because forwarding is disabled, despite:
# sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1
because of the type filter hook forward chain set to policy drop:...
- 33.3k
5
votes
Accepted
Routing traffic to virtual copy of network without namespaces
Topology
We start by configuring the network interfaces on middleman. I'm assuming that either you're logged in on the system console or you have access via an interface that's not involved in either ...
- 33.2k
4
votes
Using Linux as router with nftables - masquerade not forwarding reply back
The nftables wiki states:
"[...] you have to register the prerouting/postrouting chains even if you have no rules there since these chain will invoke the NAT engine for the packets coming in the ...
- 41
4
votes
Accepted
Can I match a set negatively in nftables?
It appears that negations of sets are working as expected (undocumented):
ip daddr { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 } \
ip daddr != { 10.0.1.2, 10.0.2.3 }
- 13.7k
4
votes
Accepted
Is it possible to filter/drop packets by MAC using nftables
Using nft, to drop all ethernet frames which are received from network interface eth0 and do not have source address of 00:00:5e:00:53:00:
nft add rule filter input iif eth0 ether saddr != 00:00:5e:...
- 14.5k
4
votes
Accepted
Using custom tables in nft
After some discussions on the #netfilter irc channel, it turns out that things are function "as designed". It is not possible for one chain to provide broader access (in the form of accept rules) than ...
- 33.2k
Only top scored, non community-wiki answers of a minimum length are eligible