Questions tagged [nftables]

packet filtering framework, userspace utility and compatibility layer for {ip,ip6}tables, developed as consolidated replacement for existing {ip,ip6,arp,eb}tables frameworks

Filter by
Sorted by
Tagged with
1
vote
0answers
44 views

Nftables systemd ExecStart and ExecReload

I have an ansible role (historically inherited) to configure nftables for RHEL8, which I have been trying to make sense of. It is copying a systemd file for nftables.service that has a following ...
0
votes
0answers
59 views

Nftables tproxy not working

I want to redirect all DNS traffic to proxy. For that i setup following rules in nftables: chain prerouting { type filter hook prerouting priority mangle; policy accept; udp dport ...
0
votes
0answers
22 views

Does IPTables make use of netfilters ingress hook?

I see that the ingress hook was added to the linux kernel in 2013. nftables makes use of this hook, was iptables ever updated to make use of it? I have found nothing so far to suggest that it does. ...
1
vote
1answer
92 views

Nftables “Error: Interface does not exist” after reboot

at using nftables on a new virtual machine (Debian 10) I installed and configured nftables as automatic service (systemd). I use also LXC and use an additional interface (lxcbr0). I recognized the ...
0
votes
0answers
24 views

nftable - forward UDP traffic to IP

I'm setting up a load balancer using HAPROXY for IOT devices sending in sensor data As HAproxy only supports TCP traffic, i need to forward a small amount of UDP traffic from the IOT devices to one of ...
0
votes
0answers
29 views

nftables - redirect port internally

i'm moving from windows to debian 10, and on windows i'm using portproxy to re-route a port netsh interface portproxy add v4tov4 listenport=9800 listenaddress=127.0.0.1 connectport=9078 ...
0
votes
1answer
35 views

nftables define statement won't accept ipv6 addresses

I am unable to create an ip set (precisely, a subnet set) with the define statement in nftables nft -f rc.nftables rc.nftables:5:17-34: Error: Could not resolve hostname: Address family for hostname ...
1
vote
0answers
48 views

Route untagged vlan to a tagged vlan with nftables

I have played around a lot with nftables, but I am stuck on this problem for the entire day. I have a wifi ssid that gets tagged vlan20. This part works, and I can see that dnsmasq is assigning ip ...
0
votes
0answers
23 views

nftables can't read default config

Nftables refuse to start and doesn't seems to understand default config file (from Archlinux package) This is the error returned by systemctl start nftables Mar 21 13:10:09 david-server nft[113257]: ...
0
votes
2answers
79 views

Is fail2ban working without firewalld?

do i need firewalld for fail2ban to work? Can fail2ban block IP's with iptables only? I've installed iptables-service on a CentOS 8 vps. I use nftables v0.9.3 (Topsy) to restrict/grant access. ...
0
votes
1answer
29 views

position and override the default nftables rules

I recently installed Centos8 on a virtual machine to try nftables as a replacement for iptables. I installed it by choosing the full server with GUI option. With nft list rulset I have a long output ...
0
votes
1answer
39 views

nftables queue with script

I am learning nftables and the goal is to filter packets based on ip and port destination. They have to be enqueued to userspace where my script will change the payload field and send out the packet ...
0
votes
0answers
33 views

How should I further troubleshoot port 53 incoming network connections?

I have a Debian 10 Buster server connected to a fiber Internet connection. I'm attempting to run a DNS service on port 53 of the server. What tools or techniques should I use to determine why packets ...
1
vote
0answers
43 views

Ping host with dual IPs on 1 IP, echo returns from other IP

I'm running Fedora 33 on a host (i5 cpu, 8Gb RAM, SSD and hdd) which is set up as a router; it has 5 NICs. I've managed to get dual internet gateways and dual LANs working reasonably well using ...
1
vote
0answers
163 views

IPv6 iptables/nftables multi-wan NETMAP can't access internal hosts from WAN2, WAN3

I have an ip6tables router with 3 WANs, each supporting IPv6. For some reason incoming connections only work for the default route, not ISPs #2 and #3. For example, I can ping the translated IP for ...
0
votes
1answer
91 views

nftables - how to log only specific type of traffic

My nftables.conf file looks like this. #!/usr/sbin/nft -f flush ruleset table inet filter { chain input { type filter hook input priority 0; # allow ...
0
votes
1answer
183 views

Podman fails to add container to a pod [firewalld, nftables]

Can't start a podman container nor can I add container to a pod on CentOS8. I've tried the usual actions, e.g.: Made sure I am starting with clean state: sudo podman system reset which has deleted ...
0
votes
0answers
84 views

Limit traffic to any one device with nftables meters

I have a Linux server (up-to-date debian buster) acting as a firewall/router to share an Internet connection among several Windows 10 and Ubuntu Linux workstations (5-10, no more than that). Since the ...
0
votes
0answers
19 views

GLOBAL lockout of ALL external incoming access attempts

I have stripped down my /etc/services file to bare minimum (according to my awareness of what is needed) for a Linux DESKTOP configuration accessing remote services and offering no services to remote ...
0
votes
1answer
83 views

nftables mangling without NOTRACK: what can happen?

I'm experimenting with stateless NAT using nftables. On the page about statelessly mangling protocol fields, the author says: Keep in mind the interactions with conntrack, flows with mangled traffic ...
1
vote
2answers
174 views

nftables does not accept port 25. Why?

Server: Debian Buster. In nftables.conf I have: chain INPUT { .. tcp dport { 25,465,587,993} log prefix "nft smtp: " accept comment "accept SMTP, SMTPS, IMAPS" .. log prefix "...
1
vote
1answer
204 views

Routing with nftables (Fedora33, nmcli, brctl)

A/ Host (Fedora 33) with Ethernet if eth0. ip 192.168.18.11(/24) and B1/ Kvm guest with if vnet0 enslaved to virbr101. ip 192.168.101.88(/24) (manual routing, static IP) or B2/ Kvm guest with if vnet1 ...
1
vote
1answer
49 views

Boot without nftables | Debian 10

While rebooting our newest strorage servers, we're experiencing a kernel error (probably) caused by nftables. Please see attached call trace: After configuring the server (incl nftables), everything ...
1
vote
1answer
238 views

RHEL/CentOS Now to add nftable rules to firewalld on system boot?

I am using firewalld on RHEL 8, and need to add a few nftable rules as well. (The nftable rules are based on the answer to CentOS 8 as NAT router with nft and firewalld - how to get it to pass TFTP?) ...
1
vote
0answers
39 views

Routing between tables in nftables

I'm looking for an equivalent to this rule. ip -4 rule add fwmark 0xfeed table 64 I understand fwmark selector can be accomplished using conntrack support. Is there anyway to specify that packets ...
1
vote
0answers
64 views

Connect two bridges only works in one direction

I have a Centos8 host with libvirt (KVM) and podman (1.6) installed. libvirt brought a bridge called "virbr0" and guests will be attached to with an address from range 192.168.122.0/24. ...
0
votes
2answers
302 views

Linux bind DNS Server is being targeted in a DNS Amplification attack

I have a Linux bind DNS Server which is being targeted in a DNS Amplification attack. I have applied DNS Response Rate Limiting and blocking of source IP Addresses, which has solved the immediate ...
4
votes
1answer
1k views

CentOS 8 as NAT router with nft and firewalld - how to get it to pass TFTP?

I am trying to set up PXE booting (which requires TFTP) on one of my networking that is hiding behind a NAT router. My question is similar to many others around the 'Net, but all the answers I found ...
1
vote
0answers
61 views

how can i block/ban an ip after a number of rejects on a mail server?

I found several attempts to use my email server as relay. The helo command was not coming from a FQDN and therefor the request got rejected. Is there a way to ban an IP address complelty after a ...
1
vote
1answer
203 views

Switch from existing firewalld configuration to nftables

I'm running a low-RAM VPS with CentOS 8. I've noticed that firewalld service uses way too much RAM (up to 20%). So I guess it may be better to switch to use only built-in nftables. I'm quite familiar ...
0
votes
0answers
107 views

Nftables, ssh server behind firewall. Pre/Post Routing

I want to make post- and prerouting rules to allow the following: I have an ssh server running on the internal network at port 22 that I want to make available externally on say port 2200. How would I ...
0
votes
0answers
36 views

reach nat defualt gateway from same interface

I created a NAT to forward traffic from one interface network to the other. The NAT default gateway works on other machines on the network (that have gateway set to NAT machine IP) but the NAT routing ...
1
vote
1answer
99 views

Should RELATED connections always be allowed in iptables, ip6tables, nftables etc?

In all examples of configuring Linux firewall rules, I see that it is necessary to allow connections which state is RELATED. nftables (link: https://wiki.nftables.org/wiki-nftables/index.php/...
0
votes
2answers
701 views

Specifying more than one interface in an nftables rule

I am in a situation where i have multiple interfaces for multiple docker networks. All docker networks should be able to access the internet, so i currently have the following nftables snippet: chain ...
0
votes
2answers
265 views

Using nftables to forward HTTP(s) traffic to VM guest without masquerade

I am currently in the process of setting secure as possible KVM based server. The VM host should be more or less invisible to the internet and only VM guests running single services should be exposed. ...
0
votes
0answers
53 views

Setup dynamic ip route via rules

I've got a setup like: |<-->|---> server 1 <---| clients <-| <--> proxy <--> |<-->|---> server 2 <---| Hope my ASCII ...
0
votes
1answer
54 views

iif/oif and old fashioned Alias Addresses?

I have an eth0 on which I have created VLAN 2554 (using ip link add). And then I have added three addresses, giving each one a label (using ip address add ... label eth0.2554:99). And ip addr shows ...
0
votes
1answer
246 views

NFTables: is it possible to forward traffic without masquerading it?

I have a remote server (B) that forwards certain incoming traffic to another port of a different server (A, dest). With "masquerade" I only see traffic coming from the forward server (B), is ...
-1
votes
1answer
639 views

Fail2ban + nftables = stderr: 'Error: Could not process rule: No such file or directory'

I've got a problem combining fail2ban and nftables. My setup is "Debian 10 + fail2ban + nftables". At the end there is a problem adding a new rule if someone is banned by fail2ban: 2020-09-...
1
vote
1answer
279 views

nftables reject resulting in a drop verdict instead

I have nftables setup to reject packets that don't match my allow block (nft list ruleset added below), but the packets are being dropped instead. For context, I have a service that listens on port ...
1
vote
1answer
320 views

Strongswan and nftables (migrating from iptables)

I am trying to migrate from iptables to nftables (Debian) and hit a wall here with the rules for Strongswan VPN. Can anybody help me translate this rules to nftables? Auto-converter could not do them. ...
1
vote
1answer
563 views

nftables does not write to syslog

Running Debian 10 on a LXC container: # apt-get -y install nftables # nft --version nftables v0.7 (Scrooge McDuck) # nft flush ruleset # nft add table inet filter # nft add chain inet filter input # ...
1
vote
2answers
679 views

nft config to make a local NATed FTP server public available

Everything will be on a isolated network, security is not an issue. eth0 is connected to the "public" network. Address assigned by DHCP. eth1 is connected to a "private network" ...
2
votes
0answers
383 views

How do I proxy all local traffic on 127.0.0.1:1080 use nftables tproxy

On my desktop linux,I want to surf the Internet through a proxy VPN. I already have a client for a transparent proxy listing on 127.0.0.1:1080. I want the traffic generated by the local process to ...
3
votes
1answer
723 views

Change policy with nftables on command line

With iptables I can change the for example INPUT policy with iptables -P INPUT DROP to drop. Is there any option to do the same with nft? Editing /etc/nftables.conf would work of course but that is ...
0
votes
1answer
42 views

nft vs iptables: inserting a rule at the top of a chain on multiple hosts

I'm managing a number of hosts that rely on nft to manage the firewall. I need to insert a rule at the top of the INPUT chain on these hosts. Under iptables, this would be as simple as running, on ...
0
votes
2answers
2k views

Debian 10: How can I disable nftables and continue to use IPTables only?

I just installed a new Debian 10 and realized that both nftables and iptables are active and somehow my IPTables rules get mixed up and don't work properly. How can I completely disable nftables and ...
2
votes
3answers
2k views

How to redirect requests on port 80 to localhost:3000 using nftables?

I would like for network traffic that arrives on 192.168.0.1:80 to be redirected to 127.0.0.1:3000. And, I would like the mapping of the response to be handled as well. My complete NAT and Filter ...
1
vote
1answer
470 views

Combined nftables rules for IPv4 and IPv6

One of the main advantages of nftables to iptables is a "Simplified dual stack IPv4/IPv6 administration, through the new inet family that allows you to register base chains that see both IPv4 and ...
4
votes
0answers
2k views

IPsets in FirewallD with Nftables backend

I upgraded my server to Fedora 32. Firewalld has switched the backend to Nftables. My setup is pretty simple. Just HTTP, HTTPS, SSH, SMTP ports open and multiple IPsets (IPv4, IPv6) to block a preset ...