Questions tagged [nftables]

packet filtering framework, userspace utility and compatibility layer for {ip,ip6}tables, developed as consolidated replacement for existing {ip,ip6,arp,eb}tables frameworks

Filter by
Sorted by
Tagged with
1 vote
1 answer
62 views

nftables ignoring should-be matches, nftables log shows nonsense frames, tcpdump shows expected frames

EDIT: Solution found. Will post after synthesization and verification. Having come across some head-scratching behavior with nftables, I am hoping for some community insights. When using the below ...
user avatar
0 votes
1 answer
40 views

Access control rely on nftables, WireGuard and Reverse Path Forwarding only

I have an idea to host a web app that without built-in authentication on my server. And protect it by nftables, WireGuard and Reverse Path Forwarding only. The web server will listen to the server's ...
user avatar
  • 13
0 votes
0 answers
18 views

Disable connection tracking

I'm on Ubuntu 22.04 and I would like to disable connection tracking for UDP port 123, so I tried: firewall-cmd --direct --add-rule ipv4 raw PREROUTING 1 -p udp --dport 123 -j NOTRACK firewall-cmd --...
user avatar
  • 243
0 votes
0 answers
74 views

ICMP TTL exceeded replies with destination IP from NAT router

I'm playing with nftables and observe strange behaviour which I cannot explain. I have three VMs, source, router and destination. All run latest Oracle EL 8.5 and are configured via nft. source has ...
user avatar
  • 1
0 votes
1 answer
170 views

Routing fwmark to VPN gateway using nftables mark

I'm trying to setup selective routing of a traffic filtered by IP address over OpenVPN on my OpenWRT router I have an OpenVPN profile up and working with route-nopull option to disable setting default ...
user avatar
0 votes
0 answers
114 views

Firewall - nftables blocks outbound traffic

I've got a VM at a hosting service and installed a basic firewall with nftables. However, when it is active, all outbound traffic seems to get blocked. For example, when trying to ping google.com, I ...
user avatar
  • 101
0 votes
1 answer
121 views

Use iptables and nftables together

Is it possible to use nftables and iptables together? How can I give iptables rules higer priority than nftables. As I am using nftables for nat and iptables to drop traffic by matching hex & ...
user avatar
  • 1
0 votes
0 answers
82 views

How to bridge only IPv6 and drop all IPv4 traffic on a Linux bridge wiith NFT?

Currently, we have a network where apps on host and VMs are connected together and all VMs are behind the NAT as below ||=> Host ISP Router => enp1s0 |--> ...
user avatar
1 vote
1 answer
50 views

config error after updating nftables

Been using nftables for the last 2 years with the same config, updated the program the other day and now its complaining that my config isnt valid even though all the documentation still says its ...
user avatar
0 votes
0 answers
380 views

can't run iptables-legacy using cli - centos8

I have a Centos-8 machine which comes with nft-tables and with ip-tables libraries installed. for example: the files: /lib64/xtables/* /lib64/libiptc.so.0.0.0 /lib64/libiptc.so.0 are all exists and ...
user avatar
-1 votes
1 answer
137 views

IPv6 not working on Debian 11 with nftables/nginx

I'm running a webserver (nginx 1.21.6) on a Debian 11 system with nftables 0.9.8. My nftables configuration is: table inet filter { chain input { type filter hook input priority filter; policy drop; ...
user avatar
0 votes
0 answers
125 views

Nftables logging with ulogd

Recently I started looking into nftables since it's going to be iptables successor. While doing so I came across some logging difficulties as maintaing separate log files for different services, and ...
user avatar
1 vote
1 answer
166 views

Do I need to migrate from iptables to nftables?

I have the following iptables rules. Forwarding packets from 1.2.3.4 and 5.6.7.8 (sources) coming to port 10000 to an external socks5 server on 10.10.10.10:1080. The server IP is 50.50.50.50 This ...
user avatar
1 vote
1 answer
143 views

How to refresh set element timeout in nftables?

How do I refresh a set element's timeout/expires value with nft before it is expired? Adding an existing element to the set does not reset the timeout/expires value: nft add element ip mytable myset { ...
user avatar
0 votes
1 answer
71 views

nftables nat counter incomplete

I'm trying to learn nftables/nat and have some simple experimental setup: Machine1 (router): - eth0 192.168.0.1 - eth1 192.168.1.1 Machine2: - eth0 192.168.1.2 For Machine1 I setup NAT: ...
user avatar
1 vote
0 answers
99 views

NFS insists to send packets over MTU, nftables might be the solution

I have an NFS mount over a Strongswan IPSec tunnel, which is encapsulated in a 6to4 tunnel. The IPSec is because I need encryption for NFS traffic, the 6to4 is because the VPS provider won't assign a ...
user avatar
0 votes
0 answers
38 views

Rewriting Packet Destination using iptables and nftables

I have a RHEL 7 (IP 192.168.0.10/24) and RHEL 8 (IP 192.168.0.11/24) host both of which are getting duplicated packets from a router which are intended for a different host (IP 192.168.1.10/24). How ...
user avatar
0 votes
0 answers
85 views

How to log fail2ban packets in nftables

I use fail2ban with an ssh jail. In my nftables directory I have a configuration file #!/usr/sbin/nft -f table ip fail2ban { chain input { type filter hook input priority 100; log ...
user avatar
1 vote
1 answer
280 views

nftables (nft) chain priority issues

nft is causing me endless headaches, no matter how I tweak the policy, I still cannot get it to function. The concept I have in mind : One "base" chain where common rules live (e.g. allow ...
user avatar
0 votes
2 answers
310 views

Why does SSH hang when using following nftables rules?

$ cat /etc/nftables.conf #!/usr/sbin/nft -f flush ruleset table ip firewall { chain input { type filter hook input priority filter; policy drop; iif "lo" accept iif != "...
user avatar
0 votes
0 answers
173 views

How to reload firewalld without loosing Libvirt iptables forwarding rules

It's been well know that firewalld will flush Libvirt rules upon reload and thus making port forwarding to VMs broken until you restart libvirtd. Here is what I did: Create /etc/systemd/system/...
user avatar
1 vote
0 answers
310 views

Filtering traffic by MAC address with nftables

TL;DR: when spoofing MAC addresses, how can I make sure the real addresses won't be leaked to the rest of the network using nftables ? Context For network security training purposes I am currently ...
user avatar
  • 457
0 votes
1 answer
401 views

NAT with masquerade on different interfaces that access different network with Nftables

I have a server that is connected to two network : 10.0.0.0/24 through an interface wlan0 192.168.1.0/24 through an interface eth0 I want to setup a Wireguard VPN to make both network accessible ...
user avatar
  • 113
0 votes
0 answers
40 views

VPN through Tor. Are there any errors in my settings and can anonymity be improved?

I need to route traffic from multiple mobile apps and all sites through tor. Some apps and websites block tor traffic. For this reason, I decided to use tor and vpn together (vpn through tor). I know ...
user avatar
  • 1
0 votes
0 answers
269 views

Tor transparent proxy on a middle box with nftables tproxy target

I have the following network: .________. ._______. | vm-cli | <==> <enp1s0| vm-gw |enp2s0> <==> internet ·--------· ·-------· vm-cli has address 192.168.255....
user avatar
  • 121
0 votes
0 answers
113 views

How to add ipvs rule to nftables?

I want to do the equivalent of iptables -t nat -A POSTROUTING -m ipvs --vaddr 1.2.3.4 -j MASQUERADE in nftables. The nftables wiki says ipvs is supported, but add rule ip nat POSTROUTING ipvs vaddr 1....
user avatar
  • 191
1 vote
1 answer
185 views

What is UDP Masquerading behavior when forwarding and listening on the same port to the same remote address?

Assuming the following: ||netns2|<-kernel routing-> netnsRoot| <-network routing-> |remote server| netns2 is a network namespace has a client that connects to the UDP server on UDP/5060 ...
user avatar
0 votes
1 answer
183 views

nftables natting with source IP

I have a server in a datacenter which is a Proxmox server. On the server (one of many, they are in a Proxmox cluster) I am hosting various VM's. Services on the VM's are exposed through iptables (...
user avatar
  • 103
0 votes
1 answer
114 views

How to open up traffic for ip protocol ESP via iptables?

I have been researching and wasn't able to find a definitive answer to the equivalent of below: apt install nftables nft add rule inet filter input ip protocol esp counter accept in iptables? Is it ...
user avatar
  • 1,263
1 vote
1 answer
73 views

nftable produce unexpected message in syslog

I have the following nftables rule: log prefix "[nftables] output denied1: " ip daddr 34.117.59.81 reject in syslog i can see the message: [nftables] output denied1: IN= OUT=br0 SRC=10.10.10....
user avatar
  • 11
0 votes
3 answers
160 views

How to Accelerate Firewalld or should it be abandoned for nftables instead?

We have a problem where we set up a server running a service and it is capable of hundreds of simultaneous connections on port 3535 (arbitrarily assigned for this application). We have firewalld ...
user avatar
  • 61
2 votes
1 answer
483 views

iptables flushed on firewalld reload

I’m running on Rocky Linux (RHEL8 based) and am kind of struggling with firewalld and iptables. Well, not really iptables anyway… Let me explain. I setup a K8S cluster on VMWare ESXi with six virtual ...
user avatar
3 votes
2 answers
185 views

NFTABLE issue: IPv6 does not behave like IPv4 with mirror config

I have an issue with IPv6 on my server. I have nginx configured to listen on port 443 from IPv4 and IPv6. And it works great: my webiste is available form Internet with TLS enabled. Things get ...
user avatar
  • 133
2 votes
1 answer
834 views

iptables/nftables: how to exclude all forwarded traffic from connection tracking on a router?

A Linux box has multiple network interfaces. IP forwarding is enabled for IPv4 and IPv6. I would like to protect the services running on the router itself via a stateful firewall. For that, ...
user avatar
  • 123
0 votes
0 answers
259 views

Migrating iptables "recent" module to nftables

I'm looking for some help migrating some old iptables rules onto a system that is only using nftables. iptables rules: iptables -A INPUT -p tcp -m tcp --dport 22 -m recent --update --seconds 30 --...
user avatar
  • 101
0 votes
1 answer
307 views

nftables loopback connections not working in CentOS 7

I have removed firewalld and installed nftables in CentOS 7 (kernel 3.10.0-1160.42.2.el7.x86_64). My ruleset is as follows: # nft list ruleset table ip my_table { set ssh_evils { ...
user avatar
0 votes
2 answers
217 views

nftables read counters as non-root user

I have set up some firewall rules using nftables. They include some data counters for some types of traffic that I'm interested to monitor. Now, I'd like to be able to have an application read those ...
user avatar
0 votes
1 answer
295 views

How to redirect DNS request to a remote systemd-resolved?

I was trying to make system-resolved as a remote DNS caching server (I know it is not intended to do so). I added the changed the net.ipv4.conf.br0.route_localnet to 1 and added the following nftable ...
user avatar
1 vote
0 answers
236 views

TPROXY interferes DNAT port forwarding rules

I'm setting up TPROXY on my VyOS router to forward certain traffic to a local transparent proxy. It works pretty well, until I discovered that all of my DNAT port forwarding rules are no longer ...
user avatar
0 votes
0 answers
729 views

`bad-setting (Reason: Unit nftables.service has a bad unit file...` when add `/etc/systemd/system` conf to nftables

System is debian 10 with nftables. I plan to make nftalbes auto restart when failed,script as below: cat << EOF >> /etc/systemd/system/nftables.service.d/override.conf [Service] Restart=on-...
user avatar
  • 845
1 vote
0 answers
158 views

how to set mtu on specfic udp connection?

is there iptables target to fragment packets, let say i have packet with length 1280 i want to split this packet into smaller 5 packets with maximum length equal 250 , is it possible to use firewall ...
user avatar
  • 11
1 vote
1 answer
85 views

How to block network connection to all `root` process?

My system is debian 10 with nftables. output of nethogs as below: ? root 192.168.2.10:59100-172.217.27.138:443 ? root 192.168.2.10:59086-172.217.27.138:443 ? root 192.168.2.10:59082-172....
user avatar
  • 845
0 votes
0 answers
59 views

Lots's of ` kernel: [ ] output chain dropped: IN= OUT=enp0s31f6 ` in `/var/log/messages`

I already disble ipv6 in mypc debian 10 system,firewall is nftable. When I check /var/log/messages,lots of kernel: [ ] output chain dropped as below: Jul 13 11:03:14 mypc kernel: [ 8206.745775] ...
user avatar
  • 845
1 vote
2 answers
966 views

nftables - limit rate behavior (error or misusage ?)

I am trying to set up a firewall with nftables but I failed to understand and implement a simple rate limit based on the documentation I have found. OS : Ubuntu 20.04 LTS nftables version : 0.9.3 (...
user avatar
2 votes
1 answer
509 views

configure my linux as a router, how do enable port forwarding with nftables?

I'm trying to configure my Gentoo Linux as a router. this is my configuration so far. WAN NIC is enp3s0 and LAN NIC is enp1s0f0 accepting connections to ICMP, tcp ports 53, 22, 80, 443, 445, 5900 and ...
user avatar
  • 323
0 votes
2 answers
275 views

nftables forwarding from wlan0 to eth0, but nothing happens

I have a Raspberry Pi that's connected to a wireless router with wlan0, and there's a server that's connected to the eth0. Both these connections work fine. The eth0 between Pi and the server is ...
user avatar
  • 115
1 vote
0 answers
192 views

Nftables systemd ExecStart and ExecReload

I have an ansible role (historically inherited) to configure nftables for RHEL8, which I have been trying to make sense of. It is copying a systemd file for nftables.service that has a following ...
user avatar
  • 65
0 votes
0 answers
773 views

Nftables tproxy not working

I want to redirect all DNS traffic to proxy. For that i setup following rules in nftables: chain prerouting { type filter hook prerouting priority mangle; policy accept; udp dport ...
user avatar
1 vote
1 answer
757 views

Nftables "Error: Interface does not exist" after reboot

at using nftables on a new virtual machine (Debian 10) I installed and configured nftables as automatic service (systemd). I use also LXC and use an additional interface (lxcbr0). I recognized the ...
user avatar
0 votes
1 answer
404 views

nftables - redirect port internally

i'm moving from windows to debian 10, and on windows i'm using portproxy to re-route a port netsh interface portproxy add v4tov4 listenport=9800 listenaddress=127.0.0.1 connectport=9078 ...
user avatar
  • 1