1

Is there a way to list the actual ports when listing the rules?

I mean:

nft list ruleset

table ip filter {
    chain INPUT {
        type filter hook input priority 0; policy drop;
        iifname "lo" counter packets 114 bytes 316154 accept
        ct state established,related counter packets 415 bytes 70571 accept
        tcp dport http counter packets 13 bytes 728 accept
        tcp dport http-alt counter packets 0 bytes 0 accept
        tcp dport tproxy counter packets 0 bytes 0 accept
        tcp dport https counter packets 0 bytes 0 accept

http is 80 I think https is 443 I think

Is there a way to list the ports not the names?

Arany Péter
  • 112
  • 1
  • 6

1 Answers1

1

@NikitaKipriyanov provided the answer to your question in the comment.

man nft

Ruleset list output formatting that modify the output of the list ruleset command:
...
-n, --numeric

Print fully numerical output.

The source of the port number <==> service name mapping is the file /etc/services which in turn based on the IANA port assignments list maintained here: http://www.iana.org/assignments/port-numbers

I really understand a preference to look at the actual port numbers:

Often (& especially the higher) port numbers can be in use by other applications/services than /etc/services service mapping suggests. And to add to the confusion: applications with an actual reserved port number are usually not prevented from using different port numbers (in addition to their own) as well.
For example I often see Squid web proxies listening on port 8080, http-alt rather than the reserved port for squid, 3128...

diya
  • 1,771
  • 3
  • 14
  • 1
    Actually I can't even check if that really work, because on my systems where I use nftables, `nft list ruleset` shows numeric ports even for ports registered in the `/etc/services`, without any additional switches. On the contrary, it requires `-S` to actually resolve those port numbers to symbolic service names. Probably different versions behave differently/. – Nikita Kipriyanov Oct 25 '22 at 12:53