Questions tagged [nftables]

packet filtering framework, userspace utility and compatibility layer for {ip,ip6}tables, developed as consolidated replacement for existing {ip,ip6,arp,eb}tables frameworks

Filter by
Sorted by
Tagged with
4
votes
1answer
951 views

Transparent firewall with nftables and VLANs

I want to ask you for best practice advice in transparent firewall build. I have 2 segments of network and CentOS serv with 2 10G interfaces. I want to filter/monitor/limit/drop traffic between ...
4
votes
1answer
577 views

Migration of ebtables arp rule to nftables

I'd like to move to nftables (Ubuntu trusty, kernel 3.19). However I wonder how to migrate ebtables rules for ARP packets: -p ARP --arp-op Request --arp-ip-src 192.168.178.237 --arp-mac-src 2:fb:c5:...
3
votes
2answers
294 views

nftables alternative for iptables -F

Simply, is there any quick alternative of iptables -F command (that just "deletes everything") for nftables? Such thing wouldn't have much theoretical purposes, but it's usually a lifesaver for ...
3
votes
1answer
793 views

How do you set a max connection limit with nftables?

I'm looking to limit the number of concurrent connections to a given service running on a Linux server. My understanding is that this can be done in iptables using the connlimit module. So for example,...
3
votes
1answer
2k views

Fail2ban with nftables and IPv6

EDIT: added additional .conf filer and slightly changed wording as suggested by Marco I'm running Fail2ban v0.10 which is supposed to support IPv6. I've set up Fail2ban with nftables according to ...
3
votes
1answer
124 views

nftable rules get invalidated on reconnect (VDSL, ppp0)

I'm rebuilding my router using nftables on debian jessie. I have a working setup up to the moment where my ISP decides to reassign a new WAN IP by reconnecting my DSL-link. After such a reconnect the ...
2
votes
1answer
54 views

nftables ip6 route to localhost/ ipv6 nat to loopback

I'm trying to route incoming http internet traffic to [::1]:8080 which is where my http server binds to. I'm using nftables on an IPv6-only device. If I add following rules: sudo nft flush ruleset ...
2
votes
1answer
88 views

How to match reqid in nftables?

It seems linux already has a module for nftables nf_xfrm, which contains some code about reqid, however there is no description about it in man page. So, how to translate the following command to ...
2
votes
1answer
293 views

How can I log packets dropped by policy in nftables?

I have a policy to drop packets in the input chain chain input { type filter hook input priority 0; policy drop; How can I log just these dropped packets?
2
votes
1answer
832 views

What wrong with snat in nftables?

I have two virtual machines (server, client) with wireguard vpn. When i try ping any IPv6 resource from client packets doesn't return to client. Tcpdump show me ICMP Reply packets in enp0s3 interface ...
2
votes
0answers
213 views

Getting NATed traffic returned back to the right interface

On a custom board (running a 4.x kernel), I have two physical ethernet interfaces and one radio modem that gives me a ppp-interface. iproute2 has been installed, and I am using nftables (not iptables)....
1
vote
1answer
119 views

How to drop packets based on a probability with nftables?

iptables has the statistic module that allows doing operations on packets based on a probability, how would I go about and do this with nftables?
1
vote
1answer
199 views

How should nftables rules using hostnames be rewritten to deal with multiple addresses?

I have this nftables rule: ip daddr { "0.nixos.pool.ntp.org", "1.nixos.pool.ntp.org", "2.nixos.pool.ntp.org", "3.nixos.pool.ntp.org" } udp dport ntp accept comment "Allow NTP traffic for system time" ...
1
vote
1answer
247 views

nftables alternative command like iptables -L -n -v

there is an alternative for command iptables -L -n -v in nftables ?? I need the counter of packages that tomb on my firewall.
1
vote
1answer
2k views

How to define port range in nftables

I want to open a range of TCP ports in nftables on my servers. Normally, in netfilter/iptables I can write the rule like this iptables -A INPUT -p tcp 1000:2000 -j ACCEPT I tried to write in the ...
1
vote
2answers
871 views

Drop fragmented packets in nftables

Using iptables is it possible to block fragmented packets with this rule: iptables -A INPUT -f -j DROP But there isn't a equivalent in nftables. There is any way to do it?
1
vote
1answer
17 views

How to flush and restore nftables rules from /etc/nftables.conf?

For iptables I used to run iptables-restore < /etc/iptables/rules.v4 which would flush rules and restore them from /etc/iptables/rules.v4. For nftables, I found nft -f /etc/nftables.conf, but the ...
1
vote
1answer
568 views

Nftables issue with ftp firewall and conntrack

With the following rules inside the nftables input chaing: tcp dport 21 ct state established,new counter accept tcp dport 20 ct state established,related counter accept tcp dport 1024-65535 ct state ...
1
vote
1answer
81 views

How to reset nftable counter?

It's really painful to use nftable. I have an ipv4 table and a input chain in it. table ip filter { # handle 7 chain input { # handle 1 type filter hook input priority 0; policy accept;...
1
vote
1answer
128 views

Masquerade with nftables

I have PC-1 with 2 uplinks (modem1 and modem2) and LAN on eth0 interface: # ip -c -brief addr lo UNKNOWN 127.0.0.1/8 eth0 UP 192.168.0.7/24 modem2 ...
1
vote
0answers
54 views

What does gc-interval in named sets actually do?

I'm testing out named sets in my nftables ruleset but I can't find any explanation of what the gc-interval parameter actually does. The documentation simply states: Garbage collection interval, ...
1
vote
0answers
92 views

altering packet content of forwarded packets with nft or iptables using queues

I need to create a moderatly large application that changes the content of forwarded packets quite drastically. I was wondering whether or not I could alter the content of a packet that is intended ...
1
vote
1answer
821 views

nftables bridge match local packets

I am using Arch linux and I have set up a bridge with bridge-utils. Now I would like to firewall it. I would like to drop some packets going through that bridge while allowing this machine to freely ...
1
vote
1answer
321 views

How to create transparent/in-line/bridging firewall via nftables?

I'm stuck at configuring nftables. table bridge filter { chain input { type filter hook input priority -200; policy accept;} chain forward { type filter hook forward priority -200; ...
1
vote
0answers
143 views

Replacing net_cls with nftables

I am currently using the net_cls cgroup to classify packets from a process and then later mangle them with iptables. From the kernel and systemd guys it seems that net_cls is deprecated and other ...
0
votes
2answers
1k views

My nftables rules blocks IPv6

My nftables.conf simply runs flush ruleset then includes my firewall rules. I’ve copied them from the Arch wiki. So the included firewall.rules contains: # An iptables-like firewall table firewall { ...
0
votes
1answer
94 views

Filter traffic from IPv4 to IPv6 and vice versa

I've tried to filter (using nftables, but I'm open for a change if it works using iptables) traffic coming from an IPv4 network to an IPv6 network, but can't figure out how to do it. Suppose I have a ...
0
votes
1answer
602 views

Rate limiting ICMP flood with nftables

I'm trying to figure out how to allow ICMP pings to a server with nftables without being subject to flood attacks. Here's my initial config: table inet firewall { chain incoming { type ...
0
votes
0answers
20 views

nftables named sets that match network prefixes though filter or variables

I want to match a set of networks. Anonymous sets works fine, but I want to create prefix set to reuse it when needed. nft add set filter AllowedSSH { type ipv4_addr\;} // type for addreses nft add ...
0
votes
1answer
11 views

nftables: Set packet mark from raw payload

I'm trying to set a packet's mark field to a 32-bit field in the (layer-5) header, using nft add rule inet filter output udp dport 31337 meta mark set @th,96,32. (I'm pulling second dword in the layer-...
0
votes
0answers
25 views

Does nftable drop invalid state connections if I only allow established and related state?

Just curious. An example in nftables wiki allow related and established connections and then drop invalid connections. Is it necessary?
0
votes
0answers
142 views

nftables with openvpn and lxc

I have a simple setup involving OpenVPN server in a LXC container (debian stretch host, debian buster container), in which i'd like to set up a firewall based on nftables. What confused me is the ...
0
votes
1answer
66 views

What is the difference between nf_table and xt_table?

There are two sets of modules in linux netfilter framework. One with nf prefix (e.g. nf_tables), another with xt prefix (e.g. xt_ecn). What is the difference between two of them?
0
votes
1answer
94 views

How can I use nftables with passive FTP?

Below are rules for allowing passive FTP that are not working. /proc/sys/net/netfilter/nf_conntrack_helper is set to 1 The nf_conntrack_ftp module is loaded. What could be blocking it? Do I really ...
0
votes
0answers
50 views

nftables not registering netbios broadcast responses as established,related traffic

I'm running Archlinux and trying to set up hostname resolution using netbios. I'm currently in the situation where resolution only works when the firewall is disabled. My test: I run 'ping SERVER' ...
0
votes
0answers
100 views

NFTables mix sets and map concatenations

I have two nft rules: iifname $lan ip protocol tcp ip saddr $lan_addresses tcp dport {3128, 22} accept iifname $vpn ip protocol tcp ip saddr $vpn_addresses tcp dport {3128, 22} accept I was ...
0
votes
0answers
332 views

Nftables Ruleset Fails to Apply Properly on Boot

Ubuntu 18.04.1. The exact same ruleset file produces different behaviour whether loaded by the system at boot (broken), or loaded manually after boot (works correctly). Specifically, when loaded at ...
0
votes
0answers
117 views

nftables and having dnat rules in “container”

I hope I can explain my wishes. I would like to explorer nftables instead of iptables. Today I use a lot of rules like: iptables -t nat -I PREROUTING -p tcp -s 10.1.10.97 -j REDIRECT --to-port 5000 ...
0
votes
1answer
478 views

nftables configuration - allow mac on tcp port

im new in firewalls etc. readed nftables quick reference how to allow only my mac address (my device - laptop, phone etc.). allow my mac to access ssh port (port:22) tried that: ether saddr 00:00:...
-2
votes
2answers
1k views

nftables dnat forwarding doesn't work properly [closed]

Greetz, I ran into a problem this morning. I'm currently migrating over from iptables to nftables. My problem is, that I'm running my containers behind nat and I want to forward my ports (e.g. 443, 80)...