Questions tagged [nftables]

packet filtering framework, userspace utility and compatibility layer for {ip,ip6}tables, developed as consolidated replacement for existing {ip,ip6,arp,eb}tables frameworks

29 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
2
votes
1answer
467 views

ufw replacement (or workaround) for Debian 10

We have servers where the admins are used to using ufw on Debian 9. Upgrading to Debian 10 means switching from iptables to nftables (yes, we could still use iptables-legacy but do not want to unless ...
2
votes
0answers
324 views

Getting NATed traffic returned back to the right interface

On a custom board (running a 4.x kernel), I have two physical ethernet interfaces and one radio modem that gives me a ppp-interface. iproute2 has been installed, and I am using nftables (not iptables)....
1
vote
1answer
32 views

Change policy with nftables on command line

With iptables I can change the for example INPUT policy with iptables -P INPUT DROP to drop. Is there any option to do the same with nft? Editing /etc/nftables.conf would work of course but that is ...
1
vote
0answers
262 views

IPsets in FirewallD with Nftables backend

I upgraded my server to Fedora 32. Firewalld has switched the backend to Nftables. My setup is pretty simple. Just HTTP, HTTPS, SSH, SMTP ports open and multiple IPsets (IPv4, IPv6) to block a preset ...
1
vote
0answers
79 views

Setting up nftables for dual stack (ICMP, http, https)

I'm having a little trouble setting up nftables on a dual stack server. My setup is debian 9.11 with nftables installed (obviously). The IPv4 part is working as expected but IPv6 is not. Output of ...
1
vote
1answer
247 views

Checking existence of IPSEC as a meta expression in nftables

Whilst recently setting up a router manually from scratch using Debian, I decided to use nftables along with strongSwan to provide an IKEv2 VPN access into this. After much frustration along with ...
1
vote
0answers
24 views

Flush old entries from nftable meter list

I use nftables to do rate limiting: chain input: { type filter hook input priority 0; policy accept; tcp dport http ct state new jump rate-limit } chain rate-limit { meter httplimit4 { ...
1
vote
0answers
81 views

nftable access to LXD container

My plan is to provide a nextcloud container and a ONLYOFFICE container. I have a ubuntu LTS server system running. There are several LXD container running. I can access all container with browser via ...
1
vote
1answer
1k views

Bridge + nftables: How to redirect incoming HTTP/HTTPS traffic to local port 8080?

I have set up a bridge and would like to redirect HTTP/HTTPS traffic traversing it to a local port (8080) so that I can further process it using mitmproxy. So far I was using a combination of ...
1
vote
1answer
1k views

How can I use nftables with passive FTP?

Below are rules for allowing passive FTP that are not working. /proc/sys/net/netfilter/nf_conntrack_helper is set to 1 The nf_conntrack_ftp module is loaded. What could be blocking it? Do I really ...
1
vote
0answers
81 views

What does gc-interval in named sets actually do?

I'm testing out named sets in my nftables ruleset but I can't find any explanation of what the gc-interval parameter actually does. The documentation simply states: Garbage collection interval, ...
1
vote
0answers
105 views

altering packet content of forwarded packets with nft or iptables using queues

I need to create a moderatly large application that changes the content of forwarded packets quite drastically. I was wondering whether or not I could alter the content of a packet that is intended ...
1
vote
1answer
438 views

How to create transparent/in-line/bridging firewall via nftables?

I'm stuck at configuring nftables. table bridge filter { chain input { type filter hook input priority -200; policy accept;} chain forward { type filter hook forward priority -200; ...
1
vote
0answers
186 views

Replacing net_cls with nftables

I am currently using the net_cls cgroup to classify packets from a process and then later mangle them with iptables. From the kernel and systemd guys it seems that net_cls is deprecated and other ...
0
votes
0answers
20 views

How do I proxy all local traffic on 127.0.0.1:1080 use nftables tproxy

On my desktop linux,I want to surf the Internet through a proxy VPN. I already have a client for a transparent proxy listing on 127.0.0.1:1080. I want the traffic generated by the local process to ...
0
votes
1answer
20 views

nft vs iptables: inserting a rule at the top of a chain on multiple hosts

I'm managing a number of hosts that rely on nft to manage the firewall. I need to insert a rule at the top of the INPUT chain on these hosts. Under iptables, this would be as simple as running, on ...
0
votes
0answers
33 views

nftables - One machine not able to access server

I am working on setting up my firewall on my server right now and it drives me crazy. I am using nftables aand have the following ruleset: table inet filter { map whitelist { type ...
0
votes
0answers
31 views

What's wrong with this nftables rule?

I'm playing around with nftables a little bit and I've set up this rule to block all traffic coming from 192.168.0.29. The curious result, however, is that it blocks the pings, but I can still SSH ...
0
votes
0answers
157 views

nftables - how do I route specific website via specific interface?

I have built my own debian 10 router for my house, principally so its an always on VPN router using openvpn, also acting as DHCP server, and encrypted DNS using dnscrypt-proxy. Everything has been ...
0
votes
0answers
145 views

Sandbox/firewall process to only connect to specific IP or host in Debian Linux

Under Linux (Debian 10), I would like to sandbox a program started via a shell script, so that it can only open a connection to a specific IP address or host, but not to any other. I am looking for a ...
0
votes
0answers
57 views

How to connect from one WAN to the other on single machine and VM network?

I have quite complicated network setup, but I am also newbie in routing and similar topics. My ISP is providing several static IPs via PPPoE, let's call them IP0, IP1, IP2, IP3 and so on. IP0 is ...
0
votes
0answers
208 views

Is it possible to get a transparent proxy with Redsocks when using the new nftables?

I've been using Redsocks for a few months now on a Ubuntu "18.04.3 LTS (Bionic Beaver)" machine. This machine has iptables, and not nftables. So I have a few rules to redirect 80,443,9048, 1935 and so ...
0
votes
0answers
753 views

Migrating from libvirt + iptables to libvirt + nftables

I'm about to migrate a Debian Stretch host using qemu-kvm to Debian Buster. I've seen people complaining on the Internet about issues due to nftables becoming default in place of iptables and libvirt ...
0
votes
0answers
209 views

nftables NAT combined with VLANs and routing

My network has a rather complex setup I can't unfortunately simplify, currently it's being half-solved by two different devices (that cause a few other problems) and I wish to replace them with one ...
0
votes
0answers
84 views

Completely delete nftables

I am not a Linux guru, but I used to do it, but now I’m completely stuck. I have Debian Jessie installed on the server, it worked fine, then someone of interns did something there and as a result, ...
0
votes
1answer
1k views

Typical port forwarding with nftables example

I want to connect to a virtual VM hosted by the server 1.2.3.4 using ssh. The IP of the VM is 10.10.10.100. "nft list ruleset" prints: table inet filter { chain input { type filter hook ...
0
votes
1answer
83 views

Does nftable drop invalid state connections if I only allow established and related state?

Just curious. An example in nftables wiki allow related and established connections and then drop invalid connections. Is it necessary?
0
votes
1answer
286 views

What is the difference between nf_table and xt_table?

There are two sets of modules in linux netfilter framework. One with nf prefix (e.g. nf_tables), another with xt prefix (e.g. xt_ecn). What is the difference between two of them?
0
votes
0answers
649 views

Nftables Ruleset Fails to Apply Properly on Boot

Ubuntu 18.04.1. The exact same ruleset file produces different behaviour whether loaded by the system at boot (broken), or loaded manually after boot (works correctly). Specifically, when loaded at ...