Questions tagged [nftables]

packet filtering framework, userspace utility and compatibility layer for {ip,ip6}tables, developed as consolidated replacement for existing {ip,ip6,arp,eb}tables frameworks

Filter by
Sorted by
Tagged with
2
votes
3answers
99 views

How to redirect requests on port 80 to localhost:3000 using nftables?

I would like for network traffic that arrives on 192.168.0.1:80 to be redirected to 127.0.0.1:3000. And, I would like the mapping of the response to be handled as well. My complete NAT and Filter ...
0
votes
1answer
26 views

Combined nftables rules for IPv4 and IPv6

One of the main advantages of nftables to iptables is a "Simplified dual stack IPv4/IPv6 administration, through the new inet family that allows you to register base chains that see both IPv4 and ...
1
vote
0answers
100 views

IPsets in FirewallD with Nftables backend

I upgraded my server to Fedora 32. Firewalld has switched the backend to Nftables. My setup is pretty simple. Just HTTP, HTTPS, SSH, SMTP ports open and multiple IPsets (IPv4, IPv6) to block a preset ...
0
votes
0answers
27 views

nftables - One machine not able to access server

I am working on setting up my firewall on my server right now and it drives me crazy. I am using nftables aand have the following ruleset: table inet filter { map whitelist { type ...
2
votes
1answer
75 views

Where are nftables counters logged/stored, and how long do they persist?

I'm attempting to track the total data being transmitted from a specific set of IP addresses (both IPv4 and IPv6) using nftables with a named counter on the rule. My goal is to be able to track this ...
1
vote
1answer
78 views

How to use defined variables in Nftables though terminal (not in script)

I want to run these two commands in a interactive shell, one after the other (as root and with the "filter" table and the "input" chain loaded): nft define lala=1.2.3.4 nft add rule ip filter input ...
1
vote
1answer
56 views

iptables-like NETMAP with nftables

using nftables, I need to NAT an entire subnet to another one for example: 10.10.10.1 -> 10.200.0.1 10.10.10.2 -> 10.200.0.2 ... 10.10.10.X -> 10.200.0.X nftables docs here shows multiple ...
0
votes
1answer
46 views

NFTables Masquerade Not Working

I am trying to setup NFTables to forward traffic coming in on a specific UDP port to another server with a different IP address. However, it appears my masquerade rule isn't working. When I send ...
1
vote
2answers
96 views

Nftables - how not to dnat an ip on interface (DNS)

I have been searching, but cannot seem to find an answer to my specific issue. I have the following rule today under prerouting: iifname "br0" udp dport 53 counter dnat to 192.168.22.5:53 However, I ...
0
votes
0answers
30 views

What's wrong with this nftables rule?

I'm playing around with nftables a little bit and I've set up this rule to block all traffic coming from 192.168.0.29. The curious result, however, is that it blocks the pings, but I can still SSH ...
1
vote
0answers
65 views

Setting up nftables for dual stack (ICMP, http, https)

I'm having a little trouble setting up nftables on a dual stack server. My setup is debian 9.11 with nftables installed (obviously). The IPv4 part is working as expected but IPv6 is not. Output of ...
1
vote
0answers
40 views

Checking existence of IPSEC as a meta expression in nftables

Whilst recently setting up a router manually from scratch using Debian, I decided to use nftables along with strongSwan to provide an IKEv2 VPN access into this. After much frustration along with ...
0
votes
0answers
121 views

nftables - how do I route specific website via specific interface?

I have built my own debian 10 router for my house, principally so its an always on VPN router using openvpn, also acting as DHCP server, and encrypted DNS using dnscrypt-proxy. Everything has been ...
0
votes
0answers
141 views

Sandbox/firewall process to only connect to specific IP or host in Debian Linux

Under Linux (Debian 10), I would like to sandbox a program started via a shell script, so that it can only open a connection to a specific IP address or host, but not to any other. I am looking for a ...
0
votes
0answers
65 views

NAT entire subnet with nftables on linux [duplicate]

In order to manage traffic for an IPSEC VPN connection, I need to NAT an entire subnet with nftables, for example: My subnet: 192.168.1.0/24 My NATed subnet (part of VPN interesting traffic, it's ...
1
vote
0answers
24 views

Flush old entries from nftable meter list

I use nftables to do rate limiting: chain input: { type filter hook input priority 0; policy accept; tcp dport http ct state new jump rate-limit } chain rate-limit { meter httplimit4 { ...
1
vote
1answer
323 views

ufw replacement (or workaround) for Debian 10

We have servers where the admins are used to using ufw on Debian 9. Upgrading to Debian 10 means switching from iptables to nftables (yes, we could still use iptables-legacy but do not want to unless ...
1
vote
0answers
72 views

nftable access to LXD container

My plan is to provide a nextcloud container and a ONLYOFFICE container. I have a ubuntu LTS server system running. There are several LXD container running. I can access all container with browser via ...
0
votes
1answer
33 views

Now to allow source IP do specific port

I want to allow IP 1.2.3.4 on port 3306 with nftables, but I was not able to find how to actually insert port? I was trying something like nft insert saddr 1.2.3.4.5 ip daddr server_ip accept
0
votes
1answer
378 views

Port redirect for all interfaces with nft (nftables)

I have a relatively simple requirement that I want to solve with nft (nftables). It is to redirect all incoming packets from port 445 to port 1445. This should be done for all network interfaces. My ...
0
votes
1answer
273 views

nftables support string matching support

Iptables can match packets by string. Example for dns: iptables -A INPUT -i eth0 -p udp --dport 53 -m string --hex-string "|09|proxypipe|03|net" --algo bm -j DROP How to perform such matching in ...
0
votes
0answers
56 views

How to connect from one WAN to the other on single machine and VM network?

I have quite complicated network setup, but I am also newbie in routing and similar topics. My ISP is providing several static IPs via PPPoE, let's call them IP0, IP1, IP2, IP3 and so on. IP0 is ...
0
votes
0answers
190 views

Is it possible to get a transparent proxy with Redsocks when using the new nftables?

I've been using Redsocks for a few months now on a Ubuntu "18.04.3 LTS (Bionic Beaver)" machine. This machine has iptables, and not nftables. So I have a few rules to redirect 80,443,9048, 1935 and so ...
1
vote
1answer
882 views

Bridge + nftables: How to redirect incoming HTTP/HTTPS traffic to local port 8080?

I have set up a bridge and would like to redirect HTTP/HTTPS traffic traversing it to a local port (8080) so that I can further process it using mitmproxy. So far I was using a combination of ...
1
vote
1answer
41 views

Nftables timestamp map

Is it possible to construct a nftables map based on timestamp? Currently I use: numgen random mod 2 map { 0: 10.10.10.1, 1: 10.10.10.2, } But how to convert the ...
0
votes
0answers
635 views

Migrating from libvirt + iptables to libvirt + nftables

I'm about to migrate a Debian Stretch host using qemu-kvm to Debian Buster. I've seen people complaining on the Internet about issues due to nftables becoming default in place of iptables and libvirt ...
1
vote
1answer
474 views

Viewing NAT connections with nftables

How to track nat outgoing connections with nftables. Just need to look at nat stats, which output addresses used more or less. root@nat-1:~# nft list table nat table ip nat { chain post { ...
0
votes
0answers
196 views

nftables NAT combined with VLANs and routing

My network has a rather complex setup I can't unfortunately simplify, currently it's being half-solved by two different devices (that cause a few other problems) and I wish to replace them with one ...
1
vote
1answer
79 views

Salt configuration for nftables prerouting

I'm trying to configure a nftables-rule for forwarding traffic from my server to a LXC container, however, the way that the salt states module for dport renders the given value is not accepted by ...
0
votes
0answers
77 views

Completely delete nftables

I am not a Linux guru, but I used to do it, but now I’m completely stuck. I have Debian Jessie installed on the server, it worked fine, then someone of interns did something there and as a result, ...
0
votes
1answer
155 views

Filter on bytes in UDP payload using nftables

Is it possible to write a nftables rule that filters on byte value(s) at an offset in a UDP payload? I am able to do so using netfilter queue in userspace, but wondering if there's an expression that ...
0
votes
1answer
963 views

Typical port forwarding with nftables example

I want to connect to a virtual VM hosted by the server 1.2.3.4 using ssh. The IP of the VM is 10.10.10.100. "nft list ruleset" prints: table inet filter { chain input { type filter hook ...
0
votes
1answer
696 views

Nftables cannot process any commands

After updating from Stretch to Buster and moving from iptables to nftables, the nft command doesn't process any given command except for list, which doesn't print anything. The input nft flush ...
7
votes
1answer
2k views

What is the different between “iifname” and “iif” in nftables?

https://wiki.nftables.org/wiki-nftables/index.php/Quick_reference-nftables_in_10_minutes#Meta Is there any difference between iifname (outside the name is string) and iif and what is recommended?
1
vote
1answer
122 views

Multiple hooks per nftables chain?

Is it possible to define multiple hooks in nftables chain or is there any other elegant way how to prevent duplicationg the rules inside (without include from another file)? table inet raw { ...
0
votes
1answer
302 views

nftables named sets that match network prefixes though filter or variables

I want to match a set of networks. Anonymous sets works fine, but I want to create prefix set to reuse it when needed. nft add set filter AllowedSSH { type ipv4_addr\;} // type for addreses nft add ...
0
votes
1answer
149 views

nftables: Set packet mark from raw payload

I'm trying to set a packet's mark field to a 32-bit field in the (layer-5) header, using nft add rule inet filter output udp dport 31337 meta mark set @th,96,32. (I'm pulling second dword in the layer-...
1
vote
1answer
336 views

How to flush and restore nftables rules from /etc/nftables.conf?

For iptables I used to run iptables-restore < /etc/iptables/rules.v4 which would flush rules and restore them from /etc/iptables/rules.v4. For nftables, I found nft -f /etc/nftables.conf, but the ...
2
votes
1answer
392 views

nftables ip6 route to localhost/ ipv6 nat to loopback

I'm trying to route incoming http internet traffic to [::1]:8080 which is where my http server binds to. I'm using nftables on an IPv6-only device. If I add following rules: sudo nft flush ruleset ...
0
votes
1answer
82 views

Does nftable drop invalid state connections if I only allow established and related state?

Just curious. An example in nftables wiki allow related and established connections and then drop invalid connections. Is it necessary?
1
vote
1answer
402 views

How to drop packets based on a probability with nftables?

iptables has the statistic module that allows doing operations on packets based on a probability, how would I go about and do this with nftables?
3
votes
1answer
671 views

How to match reqid in nftables?

It seems linux already has a module for nftables nf_xfrm, which contains some code about reqid, however there is no description about it in man page. So, how to translate the following command to ...
0
votes
1answer
272 views

What is the difference between nf_table and xt_table?

There are two sets of modules in linux netfilter framework. One with nf prefix (e.g. nf_tables), another with xt prefix (e.g. xt_ecn). What is the difference between two of them?
1
vote
1answer
1k views

How to reset nftable counter?

It's really painful to use nftable. I have an ipv4 table and a input chain in it. table ip filter { # handle 7 chain input { # handle 1 type filter hook input priority 0; policy accept;...
1
vote
1answer
820 views

Masquerade with nftables

I have PC-1 with 2 uplinks (modem1 and modem2) and LAN on eth0 interface: # ip -c -brief addr lo UNKNOWN 127.0.0.1/8 eth0 UP 192.168.0.7/24 modem2 ...
1
vote
1answer
1k views

How should nftables rules using hostnames be rewritten to deal with multiple addresses?

I have this nftables rule: ip daddr { "0.nixos.pool.ntp.org", "1.nixos.pool.ntp.org", "2.nixos.pool.ntp.org", "3.nixos.pool.ntp.org" } udp dport ntp accept comment "Allow NTP traffic for system time" ...
2
votes
2answers
2k views

How can I log packets dropped by policy in nftables?

I have a policy to drop packets in the input chain chain input { type filter hook input priority 0; policy drop; How can I log just these dropped packets?
1
vote
1answer
942 views

How can I use nftables with passive FTP?

Below are rules for allowing passive FTP that are not working. /proc/sys/net/netfilter/nf_conntrack_helper is set to 1 The nf_conntrack_ftp module is loaded. What could be blocking it? Do I really ...
1
vote
0answers
80 views

What does gc-interval in named sets actually do?

I'm testing out named sets in my nftables ruleset but I can't find any explanation of what the gc-interval parameter actually does. The documentation simply states: Garbage collection interval, ...
3
votes
1answer
2k views

How do you set a max connection limit with nftables?

I'm looking to limit the number of concurrent connections to a given service running on a Linux server. My understanding is that this can be done in iptables using the connlimit module. So for example,...