Skip to main content

Questions tagged [nftables]

packet filtering framework, userspace utility and compatibility layer for {ip,ip6}tables, developed as consolidated replacement for existing {ip,ip6,arp,eb}tables frameworks

Filter by
Sorted by
Tagged with
1 vote
2 answers
73 views

libvirt port forwarding to guest: What changed with 10.4.0?

Network/Firewalls isn't my strong side, so there is the possibility that I'm making a very basic mistake. I need to access services running inside my qemu guest system from other devices in my network....
Gedi Nixan's user avatar
0 votes
0 answers
12 views

nftables restrict access between date and time

Documentation of nftables about match concept is too weak . nftables document I want accept all traffic from ip x.w.y.z with port 80 only between two Date & Time for example : start : 2024/01/12 ...
mah454's user avatar
  • 157
0 votes
0 answers
32 views

porting iptables rules to nftables in a Linux Virtual Server direct route context

The context: I have an old LVS environment that makes an high availability load balaced dns server. I am trying to reinstall it on computers which run more recent OS, like a Deb 12 where I got the ...
Marcus's user avatar
  • 1
0 votes
1 answer
46 views

Debian NAT Gateway with dnsmasq DHCP, reachable via internal IP

I have setup a Debian 12 machine as an IPv4 NAT Gateway / Router by following the various tutorials on the internet (mostly following arch wiki) and tried to do it the most modern way possible. I use ...
kingspride's user avatar
0 votes
0 answers
90 views

Documentation for nftables

I've been migrating from "higher level" (awall, ufw, firewall-cmd, etc.) firewall tools to nftables "scripts", but the documentation experience hasn't been the best. The man pages &...
cpl's user avatar
  • 9
0 votes
1 answer
172 views

kvm libvirt: Port Forwarding via nft not working

I use KVM to virtualize a Guest-Linux-Mint on my Host-Debian12. The Guest is obviously configured well with NAT: I can ssh into the Guest from the Host, I can reach the Internet from the Guest. But I ...
Sebastian's user avatar
0 votes
1 answer
214 views

nftables + Almalinux (CPanel): Help creating rules

I need help creating rules. According to CPanel firewall-d broke migrating from CentOS > Alma Linux. They no longer supported CentOS so I bit the bullet finally and migrated. Everything went ...
wolfsden3's user avatar
0 votes
1 answer
304 views

Configuring destination NAT nftables entire subnet

Basically what I need is to change all packets destined to one subnet to a different subnet I need this because my router has 2 VPNs and both of them use the same ip range [out of my control] This is ...
94230's user avatar
  • 1
1 vote
1 answer
282 views

Bypass nftables drop rule

tldr; bridge (see below) doesn't work if there is a matching drop in another table (like the default rules of firewalld). Hello, I'm building my own VM lib (kind of quickemu). I have a problem with ...
ange's user avatar
  • 33
1 vote
2 answers
171 views

Pass web traffic to VPN endpoint other than the OpenVPN envelope through the VPN itself

I have a Linux server that is an OpenVPN endpoint, but also hosts a webserver. When my client connects to the server address for the webserver, the packets travel outside the VPN. Rightly so, since ...
user3450564's user avatar
2 votes
2 answers
917 views

nftables rules can't ping to other server

So I have a quick and dirty firewall that I plan to use on my vps using nftables. Here's the initial rule table inet filter { chain input { type filter hook input priority 0; # ...
mhd's user avatar
  • 655
0 votes
1 answer
872 views

nftables fails on boot with "Error: Could not process rule: No such file or directory chain ingress" but same nft conf works with manual nft start

Over one year I have had a working nft configuration. After updating NVM of my network cards and "apt update & upgrade" I encounter the following error on boot. But nftables starts ...
cygent's user avatar
  • 1
1 vote
2 answers
344 views

Looping forwarded and locally originating connections through port forwarding rules in firewalld

I have a Debian box running firewalld set up a as gateway NAT/router. This device has two NICS; wan --- public interface, assigned to the external firewalld zone, dynamically assigned IP address using ...
3dg3's user avatar
  • 11
1 vote
1 answer
643 views

How to use nftables dnat and redirect without preceding match

I have table ip nat { chain Redirect_to_local { limit rate 3/minute burst 10 packets log prefix "[nft.ip.dnat.8080]: " redirect to :8080 } chain ...
avi9526's user avatar
  • 175
2 votes
1 answer
159 views

Can I increase readility of nftables ruleset syntax and does it affect its function?

It is not clear to me from the manual if this commands are equal in their function: meta skuid == "root" counter accept skuid 0 counter accept also ct state == { established, related } ...
avi9526's user avatar
  • 175
0 votes
0 answers
30 views

Data from NF Tables to IP Tables

I have input data like below for NF Tables: nft add rule filter input tcp flags != syn nft add rule filter input tcp flags &syn!= syn add rule filter output tcp flags & (syn | ack) == syn | ...
Karma Yogi's user avatar
1 vote
0 answers
377 views

nftables : improve anti port scanning rules

I'm looking for ways to confuse port scanners. I do realize it is not that useful, but it is mostly to slow down attackers, and also to avoid ending up on websites like Shodan (or at least make the ...
ShellCode's user avatar
  • 121
0 votes
0 answers
88 views

How to exclude dnsmasq used by libvirt from Mullvad VPN's "local network sharing" block

I don't use the local network except dnsmasq for libvirt. With blocking local network I have no DNS on my VM. For that reason I want to exclude dnsmasq from the local network sharing block with split ...
clooney's user avatar
0 votes
0 answers
77 views

Parsing TCP flag Data for IP Tables

I have input file which has data like below chain:VARIABLE_IN ip_version:v4 proto:tcp sport:5401 dst_ip:18.159.158.206 dport:5432 decision:a tcpflags:&syn!=syn My code reads above data to form ...
Karma Yogi's user avatar
0 votes
0 answers
88 views

How to set TCP flags "&syn!=syn" in iptables?

I have requirement where am getting parameters to set in iptables as below: Rate Limit = 1/sec Source port = 5432 Source IP = 203.0.113.0 Protocol = tcp TCP flags = &syn!=syn iptables -A PRIO_IN -...
Karma Yogi's user avatar
1 vote
1 answer
366 views

Applying nftables rules to macvtap interfaces

I'm trying to expose a libvirt (qemu) virtual machine to the open world on a separate address via a promiscuous device and attached macvtap, but at the same time protect the local network from ...
Etki's user avatar
  • 129
0 votes
1 answer
168 views

Debugging combination of tproxy and policy based routing

let me preface this by saying that I know I am combining a wild amount of things in here, but sometimes that is where things take you. So the scenario: I'm using squid and tproxy to transparently ...
Mart Allini's user avatar
0 votes
1 answer
300 views

iptables not accepting my rule

I am trying to add a rule to my iptables, so that traffic trying to connect on port 9091 is forwarded to a different IP address. When searching I found this answer, which seems to fit my exact use ...
samikool's user avatar
0 votes
1 answer
249 views

How to route all traffic going to specific address to localhost using nft?

I need intercept traffic going to external IP and reroute it to localhost. Its quite simple using iptables, but I could not understand how to make it work through nft. I create table and chain inside ...
zealot's user avatar
  • 3
0 votes
2 answers
637 views

Trying to exclude traffic on specific interface from Mullvad vpn

I have an ubuntu machine with one interface connected to the internet (through mullvad). A RPi box is connected to another ethernet interface on my ubuntu box. Connection works if mullvad is turned ...
Nhfb9E's user avatar
  • 1
1 vote
1 answer
767 views

nftables: referencing a set from another table

With the following setup: #!/usr/sbin/nft -f add table ip filter add chain ip filter input { type filter hook input priority 0; } add set ip filter nat-group-1 { type ipv4_addr; } add set ip ...
Christopher Causer's user avatar
0 votes
0 answers
74 views

How can nft block excessive 443 access?

I'm having a hard time configuring nft to fight floods on 443/TCP. I gave up on iptables and module recent, and now I'm testing nft with its man page sample code, as a lab. So, I'm sending all source ...
Gilberto Martins's user avatar
0 votes
0 answers
80 views

NFTable dynamic denylist not working

I'm trying to setup an nftable rule to add source IP if IP tries to connect mulitple times via dport ssh. I'm new to nftables so I'm still trying to understand the proper way of create rules. This ...
Throdne's user avatar
  • 101
0 votes
2 answers
949 views

nftables: hairpin / loopback NAT with dynamic IP

I've a Debian 12 server (public IP 85.xxx.xxx.xxx at enp6s0) running a bunch of LXC containers on a network bridge cbr0. Since the public IP is dynamic I had to setup forward + prerouting rules with ...
TCB13's user avatar
  • 1,258
-1 votes
1 answer
132 views

nft accounting support: is this wiki example wrong?

Official nft wiki page accounting example look under 'nexthop' nft add rule filter postrouting meter acct { rt nexthop timeout 600s counter } nft add rule ip6 filter postrouting meter acct { rt ...
ArrowInTree's user avatar
1 vote
2 answers
2k views

How to use nft on linux bridge to block access to certain ip addr?

I have an Ubuntu box with a bridge br0 defined. The bridge has eth0 connected to the internet service and eth1 connected to the network port of a PC. The bridge is functioning as expected and passing ...
Michael's user avatar
  • 13
0 votes
0 answers
167 views

Nftables does not work as expected to block with meter

Goal: Account for excess packets whose rate source IP and destination port are greater than 200 packets per second, example: 1s to 2s: IP 1.1.1.1 to MyServer:80 [This happens 201 times in second 1] ...
Gabriel's user avatar
0 votes
0 answers
536 views

TPROXY is not redirecting all traffic to a specified port

I'm writing a UDP transparent proxy in Rust, I'm using several crates socket2 => Access to the creation of a RAW socket nix::sys::socket => Access to all of the low level socket API calls std::...
User582016482's user avatar
1 vote
1 answer
124 views

Bash has problems with cmdline nft cmd vs script

linux mint. uname -r yields 5.15.0-56. dpkg-query -l bash yields 5.1.6ubuntu1. My script shows this problematic output when bash -x script invoked: attrib =' '\''{type nat hook prerouting priority ...
ArrowInTree's user avatar
0 votes
0 answers
67 views

SSL Cerificates blocked by VPN?

I have a server that hosts a website delivered via https on port 443. The website is not directly open to the public internet, but traffic is routed via a VPN from an EC2 instance that has a public ...
vascowhite's user avatar
2 votes
0 answers
174 views

DHCP unicast packets processing in Linux

I'm trying to catch and process (in 3rd party analytics app) DHCP packets from ERSPAN session, but cannot do this. There is PHY interface which receive ERSPAN traffic and erspan-type interface to get ...
Volodymyr Litovka's user avatar
1 vote
1 answer
190 views

TCP Packet Loss in nftable nat chain

I am trying to connect to a Minecraft server but get a connection Timeout when tryping to connect although the Server is showing up as online Minecraft Multiplayer screen This question meight seem out ...
leonard georg's user avatar
0 votes
0 answers
1k views

Use nftables to set up IPv6 NAT to IPv4

I am working on setting up a number of EC2 instances with IPv6-only networking. A few of these servers require occasional access to IPv4-only resources controlled by third-parties. Amazon has a blog ...
Moshe Katz's user avatar
  • 3,212
0 votes
1 answer
496 views

nftables netdev rewrite - what I'm doing wrong?

[EDITED] I'm receiving on physical interface ERSPAN-encapsulated traffic and need to process just a small part of it. In order to do this, I'm decapsulating traffic on local tunnel interface: ip link ...
Volodymyr Litovka's user avatar
0 votes
1 answer
450 views

nftables masquerading is not working

I've a laptop (172.16.0.2) and a desktop PC (172.16.0.1). The phone is connected to the PC in USB modem mode, and it appears as the enp5s0f3u1 interface. I've set up masquerading through nftables so ...
BlitDev's user avatar
0 votes
0 answers
346 views

Nftables DNAT from external to internal interface and different port where Web server is binded to, how?

There is multihomed Ubuntu 22.04: internal 192.168.0.99/24 external 12.12.12.12/29 (for example) acting as gateway also. All, including internet access from the server as well as from the Lan behind ...
CpServiceSPb's user avatar
0 votes
0 answers
335 views

nftables Rules for ProxyChains-over-Tor

I am trying to configure nftables rules for ProxyChains-over-Tor, so that: My system --> Tor SOCKS5 proxy --> HTTP proxy --> Internet My system can only communicate with Tor SOCKS5 proxy Tor ...
user73q3277y23's user avatar
0 votes
0 answers
97 views

Script to filter nginx logs to automatically running nftables

I have a domain served by nginx. nginx logs have this format: 178.128.120.151 - - [19/Jul/2023:20:27:25 +0200] "GET /favicon.ico HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT ...
somenxavier's user avatar
1 vote
0 answers
552 views

nft Quality of Service (qos)

Is there any way to have a QoS over nftables. I have a webserver and I want to restrict that HTTP input traffic should have maximum of 90% of bandwith. Is it possible? Nothing found in official ...
somenxavier's user avatar
0 votes
0 answers
90 views

nftables: VM to VM Communication over Host IP

I have the following situation: A Debian Linux host with multiple VMs running on it. One VM is set up as a mail server. nftables on the host redirects the mail traffic from the world to the mail VM ...
jb_alvarado's user avatar
0 votes
1 answer
107 views

Compare on-disk rules and in-memory rules (find the difference) for nftables

I want to check that rules was loaded (e.g. ruleset in files are the same as in the kernel). I want to do it without modifying kernel rules. I can't compare files and nft list ruleset due to ordering, ...
George Shuklin's user avatar
1 vote
1 answer
285 views

nftables chain priority not working

So I have two input chains, input and dyn which is dynamically generated. However the rules of dyn just don't work because of input. I've tried setting the priority of input to 1, and the dyn to 0 ...
Nikk's user avatar
  • 239
0 votes
0 answers
62 views

Configure network stack to consume data from TAP device, so that application can operate as if the data was intended to it

I have two devices communicating, A and B over udp. In between there is a tap device, where C is connected. In order for C to be able to receive the traffic it needs to set the same ip and mac address ...
Aleksandarf's user avatar
0 votes
0 answers
76 views

Redirect traffic in "sniff/tap?" mode to specific ip address(es), that is: rewrite destination headers to target other machine(s)

I have incoming traffic on eth1 (vlan id 201) which is emitted by another machine which is doing sudo tcpreplay -x 0.01 --loop=0 --intf1=eth12 Wireshark_bidirectional_data.pcap I would like to ...
Aleksandarf's user avatar
0 votes
1 answer
102 views

nftabels rules and rc.local

i have problem like this this is my iptables rules sysctl net.ipv4.ip_forward=1 iptables -t nat -A PREROUTING -p tcp --dport 22 -j DNAT --to-destination (( my first server )) iptables -t nat -A ...
E M A's user avatar
  • 1

1
2 3 4 5