Questions tagged [nftables]

packet filtering framework, userspace utility and compatibility layer for {ip,ip6}tables, developed as consolidated replacement for existing {ip,ip6,arp,eb}tables frameworks

15 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
2
votes
1answer
301 views

How can I log packets dropped by policy in nftables?

I have a policy to drop packets in the input chain chain input { type filter hook input priority 0; policy drop; How can I log just these dropped packets?
2
votes
0answers
215 views

Getting NATed traffic returned back to the right interface

On a custom board (running a 4.x kernel), I have two physical ethernet interfaces and one radio modem that gives me a ppp-interface. iproute2 has been installed, and I am using nftables (not iptables)....
1
vote
0answers
54 views

What does gc-interval in named sets actually do?

I'm testing out named sets in my nftables ruleset but I can't find any explanation of what the gc-interval parameter actually does. The documentation simply states: Garbage collection interval, ...
1
vote
0answers
93 views

altering packet content of forwarded packets with nft or iptables using queues

I need to create a moderatly large application that changes the content of forwarded packets quite drastically. I was wondering whether or not I could alter the content of a packet that is intended ...
1
vote
1answer
325 views

How to create transparent/in-line/bridging firewall via nftables?

I'm stuck at configuring nftables. table bridge filter { chain input { type filter hook input priority -200; policy accept;} chain forward { type filter hook forward priority -200; ...
1
vote
0answers
150 views

Replacing net_cls with nftables

I am currently using the net_cls cgroup to classify packets from a process and then later mangle them with iptables. From the kernel and systemd guys it seems that net_cls is deprecated and other ...
0
votes
0answers
24 views

nftables named sets that match network prefixes though filter or variables

I want to match a set of networks. Anonymous sets works fine, but I want to create prefix set to reuse it when needed. nft add set filter AllowedSSH { type ipv4_addr\;} // type for addreses nft add ...
0
votes
0answers
26 views

Does nftable drop invalid state connections if I only allow established and related state?

Just curious. An example in nftables wiki allow related and established connections and then drop invalid connections. Is it necessary?
0
votes
0answers
168 views

nftables with openvpn and lxc

I have a simple setup involving OpenVPN server in a LXC container (debian stretch host, debian buster container), in which i'd like to set up a firewall based on nftables. What confused me is the ...
0
votes
1answer
68 views

What is the difference between nf_table and xt_table?

There are two sets of modules in linux netfilter framework. One with nf prefix (e.g. nf_tables), another with xt prefix (e.g. xt_ecn). What is the difference between two of them?
0
votes
1answer
99 views

How can I use nftables with passive FTP?

Below are rules for allowing passive FTP that are not working. /proc/sys/net/netfilter/nf_conntrack_helper is set to 1 The nf_conntrack_ftp module is loaded. What could be blocking it? Do I really ...
0
votes
0answers
51 views

nftables not registering netbios broadcast responses as established,related traffic

I'm running Archlinux and trying to set up hostname resolution using netbios. I'm currently in the situation where resolution only works when the firewall is disabled. My test: I run 'ping SERVER' ...
0
votes
0answers
104 views

NFTables mix sets and map concatenations

I have two nft rules: iifname $lan ip protocol tcp ip saddr $lan_addresses tcp dport {3128, 22} accept iifname $vpn ip protocol tcp ip saddr $vpn_addresses tcp dport {3128, 22} accept I was ...
0
votes
0answers
334 views

Nftables Ruleset Fails to Apply Properly on Boot

Ubuntu 18.04.1. The exact same ruleset file produces different behaviour whether loaded by the system at boot (broken), or loaded manually after boot (works correctly). Specifically, when loaded at ...
0
votes
0answers
118 views

nftables and having dnat rules in “container”

I hope I can explain my wishes. I would like to explorer nftables instead of iptables. Today I use a lot of rules like: iptables -t nat -I PREROUTING -p tcp -s 10.1.10.97 -j REDIRECT --to-port 5000 ...