1

Is it possible to use nftables and iptables together? How can I give iptables rules higer priority than nftables. As I am using nftables for nat and iptables to drop traffic by matching hex & string.

These are the iptables rules which I wanted to use. If someone can translate them for nftable then also it will work as iptable-translate utility is also failing in this case.

sudo iptables -t mangle -A PREROUTING -s 45.62.140.0/24 -p udp -m udp --dport 11011 -m string --hex-string '|ffffffff54|' --algo bm --to 65535 -j DROP
sudo iptables -t mangle -A PREROUTING -s 45.62.140.0/24 -p udp -m udp --dport 11011 -m string --hex-string '|ffffffff41|' --algo bm --to 65535 -j DROP
sudo iptables -t mangle -A PREROUTING -s 45.62.140.0/24 -p udp -m udp --dport 11011 -m string --hex-string '|ffffffff55|' --algo bm --to 65535 -j DROP
sudo iptables -t mangle -A PREROUTING -s 45.62.140.0/24 -p udp -m udp --dport 11011 -m string --string 'TSource Engine Query' --algo kmp --to 65535 -j DROP

T.I.A

ph3ro
  • 135
  • 5
  • Not quiete an answer, but this page should give you some help: https://wiki.nftables.org/wiki-nftables/index.php/Moving_from_iptables_to_nftables – paladin May 12 '22 at 12:00
  • Check here: https://serverfault.com/questions/998962/nftables-support-string-matching-support – Martin May 12 '22 at 12:45
  • See this related Q/A on UL SE: https://unix.stackexchange.com/questions/419851/when-and-how-to-use-chain-priorities-in-nftables – A.B Jun 11 '22 at 15:40

1 Answers1

1

You can run both, iptables rules will be applied, then nftables one. In this order. If you want a packet to go to nftables, you juste have not to drop it in iptables.

If you expect to do DNAT in nftables, then filtering in iptables, you can't then, so you would need to use only iptables or only nftables.

setenforce 1
  • 1,200
  • 6
  • 10
  • 1
    Not "in this order". Either undefined order if hook priority of nftables is the same as iptables', or in order determined by hook priority if not. since kernel 4.18 there's no special issue with using NAT in both too. – A.B Jun 11 '22 at 15:34