Questions tagged [nftables]

packet filtering framework, userspace utility and compatibility layer for {ip,ip6}tables, developed as consolidated replacement for existing {ip,ip6,arp,eb}tables frameworks

Filter by
Sorted by
Tagged with
7
votes
1answer
2k views

What is the different between “iifname” and “iif” in nftables?

https://wiki.nftables.org/wiki-nftables/index.php/Quick_reference-nftables_in_10_minutes#Meta Is there any difference between iifname (outside the name is string) and iif and what is recommended?
4
votes
1answer
2k views

Transparent firewall with nftables and VLANs

I want to ask you for best practice advice in transparent firewall build. I have 2 segments of network and CentOS serv with 2 10G interfaces. I want to filter/monitor/limit/drop traffic between ...
4
votes
1answer
5k views

Fail2ban with nftables and IPv6

EDIT: added additional .conf filer and slightly changed wording as suggested by Marco I'm running Fail2ban v0.10 which is supposed to support IPv6. I've set up Fail2ban with nftables according to ...
4
votes
1answer
917 views

Migration of ebtables arp rule to nftables

I'd like to move to nftables (Ubuntu trusty, kernel 3.19). However I wonder how to migrate ebtables rules for ARP packets: -p ARP --arp-op Request --arp-ip-src 192.168.178.237 --arp-mac-src 2:fb:c5:...
3
votes
2answers
347 views

nftables alternative for iptables -F

Simply, is there any quick alternative of iptables -F command (that just "deletes everything") for nftables? Such thing wouldn't have much theoretical purposes, but it's usually a lifesaver for ...
3
votes
1answer
719 views

How to match reqid in nftables?

It seems linux already has a module for nftables nf_xfrm, which contains some code about reqid, however there is no description about it in man page. So, how to translate the following command to ...
3
votes
2answers
2k views

How can I log packets dropped by policy in nftables?

I have a policy to drop packets in the input chain chain input { type filter hook input priority 0; policy drop; How can I log just these dropped packets?
3
votes
1answer
2k views

How do you set a max connection limit with nftables?

I'm looking to limit the number of concurrent connections to a given service running on a Linux server. My understanding is that this can be done in iptables using the connlimit module. So for example,...
3
votes
1answer
165 views

nftable rules get invalidated on reconnect (VDSL, ppp0)

I'm rebuilding my router using nftables on debian jessie. I have a working setup up to the moment where my ISP decides to reassign a new WAN IP by reconnecting my DSL-link. After such a reconnect the ...
2
votes
1answer
4k views

How to define port range in nftables

I want to open a range of TCP ports in nftables on my servers. Normally, in netfilter/iptables I can write the rule like this iptables -A INPUT -p tcp 1000:2000 -j ACCEPT I tried to write in the ...
2
votes
2answers
1k views

Drop fragmented packets in nftables

Using iptables is it possible to block fragmented packets with this rule: iptables -A INPUT -f -j DROP But there isn't a equivalent in nftables. There is any way to do it?
2
votes
3answers
126 views

How to redirect requests on port 80 to localhost:3000 using nftables?

I would like for network traffic that arrives on 192.168.0.1:80 to be redirected to 127.0.0.1:3000. And, I would like the mapping of the response to be handled as well. My complete NAT and Filter ...
2
votes
1answer
111 views

Where are nftables counters logged/stored, and how long do they persist?

I'm attempting to track the total data being transmitted from a specific set of IP addresses (both IPv4 and IPv6) using nftables with a named counter on the rule. My goal is to be able to track this ...
2
votes
1answer
417 views

nftables ip6 route to localhost/ ipv6 nat to loopback

I'm trying to route incoming http internet traffic to [::1]:8080 which is where my http server binds to. I'm using nftables on an IPv6-only device. If I add following rules: sudo nft flush ruleset ...
2
votes
1answer
472 views

ufw replacement (or workaround) for Debian 10

We have servers where the admins are used to using ufw on Debian 9. Upgrading to Debian 10 means switching from iptables to nftables (yes, we could still use iptables-legacy but do not want to unless ...
2
votes
0answers
324 views

Getting NATed traffic returned back to the right interface

On a custom board (running a 4.x kernel), I have two physical ethernet interfaces and one radio modem that gives me a ppp-interface. iproute2 has been installed, and I am using nftables (not iptables)....
1
vote
1answer
92 views

How to use defined variables in Nftables though terminal (not in script)

I want to run these two commands in a interactive shell, one after the other (as root and with the "filter" table and the "input" chain loaded): nft define lala=1.2.3.4 nft add rule ip filter input ...
1
vote
1answer
574 views

Viewing NAT connections with nftables

How to track nat outgoing connections with nftables. Just need to look at nat stats, which output addresses used more or less. root@nat-1:~# nft list table nat table ip nat { chain post { ...
1
vote
1answer
137 views

Multiple hooks per nftables chain?

Is it possible to define multiple hooks in nftables chain or is there any other elegant way how to prevent duplicationg the rules inside (without include from another file)? table inet raw { ...
1
vote
1answer
418 views

How to drop packets based on a probability with nftables?

iptables has the statistic module that allows doing operations on packets based on a probability, how would I go about and do this with nftables?
1
vote
1answer
1k views

How should nftables rules using hostnames be rewritten to deal with multiple addresses?

I have this nftables rule: ip daddr { "0.nixos.pool.ntp.org", "1.nixos.pool.ntp.org", "2.nixos.pool.ntp.org", "3.nixos.pool.ntp.org" } udp dport ntp accept comment "Allow NTP traffic for system time" ...
1
vote
1answer
1k views

Rate limiting ICMP flood with nftables

I'm trying to figure out how to allow ICMP pings to a server with nftables without being subject to flood attacks. Here's my initial config: table inet firewall { chain incoming { type ...
1
vote
1answer
425 views

nftables alternative command like iptables -L -n -v

there is an alternative for command iptables -L -n -v in nftables ?? I need the counter of packages that tomb on my firewall.
1
vote
1answer
74 views

iptables-like NETMAP with nftables

using nftables, I need to NAT an entire subnet to another one for example: 10.10.10.1 -> 10.200.0.1 10.10.10.2 -> 10.200.0.2 ... 10.10.10.X -> 10.200.0.X nftables docs here shows multiple ...
1
vote
1answer
46 views

Nftables timestamp map

Is it possible to construct a nftables map based on timestamp? Currently I use: numgen random mod 2 map { 0: 10.10.10.1, 1: 10.10.10.2, } But how to convert the ...
1
vote
1answer
85 views

Salt configuration for nftables prerouting

I'm trying to configure a nftables-rule for forwarding traffic from my server to a LXC container, however, the way that the salt states module for dport renders the given value is not accepted by ...
1
vote
1answer
370 views

How to flush and restore nftables rules from /etc/nftables.conf?

For iptables I used to run iptables-restore < /etc/iptables/rules.v4 which would flush rules and restore them from /etc/iptables/rules.v4. For nftables, I found nft -f /etc/nftables.conf, but the ...
1
vote
1answer
1k views

How to reset nftable counter?

It's really painful to use nftable. I have an ipv4 table and a input chain in it. table ip filter { # handle 7 chain input { # handle 1 type filter hook input priority 0; policy accept;...
1
vote
1answer
1k views

Nftables issue with ftp firewall and conntrack

With the following rules inside the nftables input chaing: tcp dport 21 ct state established,new counter accept tcp dport 20 ct state established,related counter accept tcp dport 1024-65535 ct state ...
1
vote
1answer
34 views

Change policy with nftables on command line

With iptables I can change the for example INPUT policy with iptables -P INPUT DROP to drop. Is there any option to do the same with nft? Editing /etc/nftables.conf would work of course but that is ...
1
vote
0answers
271 views

IPsets in FirewallD with Nftables backend

I upgraded my server to Fedora 32. Firewalld has switched the backend to Nftables. My setup is pretty simple. Just HTTP, HTTPS, SSH, SMTP ports open and multiple IPsets (IPv4, IPv6) to block a preset ...
1
vote
2answers
154 views

Nftables - how not to dnat an ip on interface (DNS)

I have been searching, but cannot seem to find an answer to my specific issue. I have the following rule today under prerouting: iifname "br0" udp dport 53 counter dnat to 192.168.22.5:53 However, I ...
1
vote
0answers
79 views

Setting up nftables for dual stack (ICMP, http, https)

I'm having a little trouble setting up nftables on a dual stack server. My setup is debian 9.11 with nftables installed (obviously). The IPv4 part is working as expected but IPv6 is not. Output of ...
1
vote
1answer
247 views

Checking existence of IPSEC as a meta expression in nftables

Whilst recently setting up a router manually from scratch using Debian, I decided to use nftables along with strongSwan to provide an IKEv2 VPN access into this. After much frustration along with ...
1
vote
0answers
24 views

Flush old entries from nftable meter list

I use nftables to do rate limiting: chain input: { type filter hook input priority 0; policy accept; tcp dport http ct state new jump rate-limit } chain rate-limit { meter httplimit4 { ...
1
vote
0answers
81 views

nftable access to LXD container

My plan is to provide a nextcloud container and a ONLYOFFICE container. I have a ubuntu LTS server system running. There are several LXD container running. I can access all container with browser via ...
1
vote
1answer
1k views

Bridge + nftables: How to redirect incoming HTTP/HTTPS traffic to local port 8080?

I have set up a bridge and would like to redirect HTTP/HTTPS traffic traversing it to a local port (8080) so that I can further process it using mitmproxy. So far I was using a combination of ...
1
vote
1answer
866 views

Masquerade with nftables

I have PC-1 with 2 uplinks (modem1 and modem2) and LAN on eth0 interface: # ip -c -brief addr lo UNKNOWN 127.0.0.1/8 eth0 UP 192.168.0.7/24 modem2 ...
1
vote
1answer
1k views

How can I use nftables with passive FTP?

Below are rules for allowing passive FTP that are not working. /proc/sys/net/netfilter/nf_conntrack_helper is set to 1 The nf_conntrack_ftp module is loaded. What could be blocking it? Do I really ...
1
vote
0answers
81 views

What does gc-interval in named sets actually do?

I'm testing out named sets in my nftables ruleset but I can't find any explanation of what the gc-interval parameter actually does. The documentation simply states: Garbage collection interval, ...
1
vote
0answers
105 views

altering packet content of forwarded packets with nft or iptables using queues

I need to create a moderatly large application that changes the content of forwarded packets quite drastically. I was wondering whether or not I could alter the content of a packet that is intended ...
1
vote
1answer
2k views

nftables bridge match local packets

I am using Arch linux and I have set up a bridge with bridge-utils. Now I would like to firewall it. I would like to drop some packets going through that bridge while allowing this machine to freely ...
1
vote
1answer
438 views

How to create transparent/in-line/bridging firewall via nftables?

I'm stuck at configuring nftables. table bridge filter { chain input { type filter hook input priority -200; policy accept;} chain forward { type filter hook forward priority -200; ...
1
vote
1answer
1k views

What wrong with snat in nftables?

I have two virtual machines (server, client) with wireguard vpn. When i try ping any IPv6 resource from client packets doesn't return to client. Tcpdump show me ICMP Reply packets in enp0s3 interface ...
1
vote
0answers
186 views

Replacing net_cls with nftables

I am currently using the net_cls cgroup to classify packets from a process and then later mangle them with iptables. From the kernel and systemd guys it seems that net_cls is deprecated and other ...
0
votes
2answers
2k views

My nftables rules blocks IPv6

My nftables.conf simply runs flush ruleset then includes my firewall rules. I’ve copied them from the Arch wiki. So the included firewall.rules contains: # An iptables-like firewall table firewall { ...
0
votes
1answer
179 views

Filter traffic from IPv4 to IPv6 and vice versa

I've tried to filter (using nftables, but I'm open for a change if it works using iptables) traffic coming from an IPv4 network to an IPv6 network, but can't figure out how to do it. Suppose I have a ...
0
votes
1answer
65 views

Debian 10: How can I disable nftables and continue to use IPTables only?

I just installed a new Debian 10 and realized that both nftables and iptables are active and somehow my IPTables rules get mixed up and don't work properly. How can I completely disable nftables and ...
0
votes
1answer
45 views

Combined nftables rules for IPv4 and IPv6

One of the main advantages of nftables to iptables is a "Simplified dual stack IPv4/IPv6 administration, through the new inet family that allows you to register base chains that see both IPv4 and ...
0
votes
1answer
319 views

nftables support string matching support

Iptables can match packets by string. Example for dns: iptables -A INPUT -i eth0 -p udp --dport 53 -m string --hex-string "|09|proxypipe|03|net" --algo bm -j DROP How to perform such matching in ...