Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [nftables]

packet filtering framework, userspace utility and compatibility layer for {ip,ip6}tables, developed as consolidated replacement for existing {ip,ip6,arp,eb}tables frameworks

219 questions
0
votes
1 answer

nftables doesnt start && nftables.conf syntax error

This is my nftables.conf: #!/usr/bin/env nft -f flush ruleset define interface = "venet0" table inet filter { set tcp_ok { type inet_service } set udp_ok { type inet_service } set trusted { type ipv4_addr } set filter…
MKDE
  • 1
  • 2
0
votes
4 answers

nftables firewall configuration on Rocky 9.1

I have installed K3s with Rancher on Rocky 9.1 machine. According to the manual, firewalld must be turned off. To turn off the firewalld, I performed: systemctl disable firewalld systemctl mask --now firewalld I also enabled the nftables service…
user2780979
  • 1
  • 2
0
votes
0 answers

Port Forwarding with Nftables didnt work

I have a small VPS running WireGuard. However, I would like to set up an IP redirection with nftables. The problem is that I've been trying for days but I can't get ahead. It is probably a simple mistake on my part. When I call curl 10.3.10.24, I…
Jonathan
  • 43
  • 6
0
votes
0 answers

nftables and OCSP stapling

My apache error log shows: AH01972: could not resolve address of OCSP responder ocsp.usertrust.com Main reason is my server's nftables blocks any requests to the Internet. In my opinion web server not should to initiate any connections to the…
gorek
  • 1
0
votes
1 answer

Static route via nftables firewall

I have a gateway "X" with 2 NICs enp0s3 (192.168.0.100) connected to 192.168.0.0/24 (let's assume this is a WAN network) enp0s8 (172.16.0.1) connected to 172.16.0.0/24 (presumably a LAN network) I have created a NAT connection using nftables to…
asteway
  • 1
  • 2
0
votes
0 answers

CentOS - nft route beetween two interfaces

I have a server with 2 network cards. I want to route from the 192.168.0.0/24 network to the 192.168.112.0/24 network and back the same way. What am I doing wrong? I have already set forwarding. See below 1: lo: mtu 65536…
dima1002
  • 1
0
votes
0 answers

Tracing a packet across a DNAT boundary and into OpenVSwitch

I am trying to figure out where a connection is getting dropped in a complex SDN environment that involves a combination of nftables rules and an OpenVSwitch switch with complex flow rules. I have a connection originating from 111.222.73.199 (not a…
larsks
  • 43,623
  • 14
  • 121
  • 180
0
votes
0 answers

Translating iptables (hex) string match, algo bm, rules to nftables

iptables to nftables scripts cannot translate/parse these two rules, help needed: -A FORWARD -i pppoe-wan -p tcp --sport 80 --algo bm --match string --string "Location: http://blackhole.int" -j DROP -A FORWARD -i pppoe-wan -p udp --sport 53 --algo…
Artem S. Tashkinov
  • 141
  • 4
0
votes
0 answers

How nft ruleset merge?

I have some nft rules configured on system A. I want to move all the rules from system A to system B. But on system B, I also have set some nft rules, and I need them. If I do, on system A nft list ruleset > ruleset-a.nft Then on system B, nft -f…
David S.
  • 181
  • 11
0
votes
0 answers

Can you explain how my external IP works with these nftable rules?

My server (under my control) is connected to a Cisco router (not under my control) It is Debian linux server My Server IP: 10.119.248.14 (in /etc/network/interfaces) My ISP have given me 14.139.114.115 as my external IP Then ISP asked me to do…
ShaileshKumarMPatel
  • 21
  • 2
0
votes
1 answer

1 Interface with 2 IP's. How can I make UFW or Firewall-Cmd make different rulesets per IP

So I have a server with 1 interface "Eth0" and that interface has 2 IP's 192.168.0.10 -> Apache2 192.168.0.20 -> NginX They share the same default gateway. How can I make Firewall rules for each individual IP?
Definity
  • 127
  • 6
0
votes
2 answers

Best way o allow only 2 countries IP acces server

i have a VPS with apache2 and 3 virtual hosts, i see a lot of ips trying to accees resources that does not exist, i also see a lot of ssh incorrect users and password tying access he server, so I need ONLY ALLOW Incoming traffic to only 1 country,…
Diego
  • 1
  • 2
0
votes
0 answers

1:1 NAT or MultiIP for WAN implementation on OpenWRT NFTABLES (fw4)

I would like to configure 1:1 NAT for my ISP modem connected to my OpenWRT WAN interface. The modem IP address is 10.70.70.1 and I want to map it on my OpenWRT LAN bridge (192.168.64.0/24) with IP address 192.168.64.171. My DHCP range for the LAN…
Sina S.
  • 11
  • 1
  • 2
0
votes
0 answers

nftables or fw4 issue with timebased traffic rules

Since the OpenWRT ver > 22.3 does use NFTABLES instead of IPTABLES I got issue with some firewall (fw4) time based traffic rules that I have no idea how to solve them. The firewall rule is as follows config rule option name 'Block-Traffic' …
Sina S.
  • 11
  • 1
  • 2
0
votes
1 answer

WireGuard full tunnel blocks Internet access

Thanks for even clicking on my question ! So, I have an R-Pi, and I installed WireGuard on it (I am NOT using PiVPN; I tried, but it wasn't working at all). I also have PiHole installed. I have been following the WireGuard guide of the PiHole docs…
Silloky
  • 1
  • 1
  • 4
1 2 3
…
14 15