packet filtering framework, userspace utility and compatibility layer for {ip,ip6}tables, developed as consolidated replacement for existing {ip,ip6,arp,eb}tables frameworks
Questions tagged [nftables]
219 questions
1
vote
1 answer
nftables chain priority not working
So I have two input chains, input and dyn which is dynamically generated.
However the rules of dyn just don't work because of input. I've tried setting the priority of input to 1, and the dyn to 0 even -200. Still nothing.
When I flush the input…
Nikk
- 239
- 1
- 4
- 10
1
vote
1 answer
Whitelist cgroup from wireguard VPN
I have a wireguard VPN, setup and enabled through NetworkManager, called wg0. I want to allow a program to access the internet directly without going through the tunnel. For this I’m trying to match by cgroupv2
Here’s what the routing looks like:
>…
Cimbali
- 183
- 8
1
vote
1 answer
nftables: Possible to block SYN packets with payload?
Is it possible to drop all TCP SYN packets with a payload using nftables?
The man pages mention various length options, but none that I could get to work for TCP packets without syntax errors.
I am using kernel v6.2.10, and nftables v1.0.7.
c44761
- 13
- 3
1
vote
1 answer
nftables: getting a per-port whitelist to work
Setup: Ubuntu 20.04, created a bridge "br0" with brctl, added three physical ports to it: enp10s0, enp7s0 and enp5s0.
The desire: enp5s0 and enp7s0 should be able to talk to each other on the bridge unimpeded (in the end, there will be more than…
JamieB
- 165
- 4
1
vote
1 answer
Packets dropped when the target addresses (mac and ip) are changed to own hosts interface
My host acts as a router and has two network interfaces enp1s0 (1 host connected with ip 192.168.10.20) and enp2s0. enp1s0 is used to receive UDP packages and enp2s0 usually has the listening hosts connected.
When I activate the nftables logging…
guenhter
- 121
- 5
1
vote
1 answer
nftables set of couples { IP/MAC address }
Is it possible to do something like this :
set authorized {
type ipv4_addr ether_addr
flags constant
elements = {
{ ipaddr: 192.168.1.xx, etheraddr: xx:xx:xx:xx:xx:xx },
{ ipaddr: 192.168.1.xx, etheraddr:…
John Doe
- 125
- 1
- 7
1
vote
0 answers
Filtering traffic by MAC - nftables
TL:DR : I am building a network tap with a raspberry-pi that must remains stealth. I have a bridge (br0) between the switch interface (eth0) and the workstation (eth1).
Here is how i am building it (open to any suggestion):
# Create a bridge with…
m4ki3lf0
- 41
- 3
1
vote
1 answer
AlmaLinux 9/RHEL and nftables : Keep getting "type filter hook input priority filter" at chain
Good day to all!
First of all, i have to say i'm a Linux novice and new to StackExchange so i hope i'm asking my question the right way.
I would like to use nftables as firewall on a new AlmaLinux installation (v9.1, minimal install, headless…
HenkH
- 13
- 4
1
vote
1 answer
IPv6 port scanners hang after scanning a closed port
I am testing nftables firewall rules using two virtual machines, one with the active firewall and one that tries to connect to it.
For example with netcat and no firewall:
nc -6 fe80::9d08:b3e2:47fa:2935%ens33
responds successfully with…
stmas
- 11
- 1
1
vote
0 answers
Assign outlet IP for a libvirt VM using routed network
My host network interface has got two IPs. Currently, I'm running my VMs in a routed network.
Host's network interface is a member of public zone in firewalld, with both forward and masquerade enabled.
With the setup described before, the VM is able…
Yu Ling
- 13
- 4
1
vote
1 answer
Cannot access website in LAN. NAT Hairpinning in nftables
I am trying to get NAT hairpinning working on my router. I cannot access my local website host on my LAN (192.168.1.3). I am using nftables with the following config:
enp1s0 = WAN
enp2s0 = LAN
#!/sbin/nft -f
flush ruleset
table ip nat {
…
whitleystriber
- 11
- 1
1
vote
0 answers
nftables rules to allow networked Docker containers on the same host to use their public URLs
I am running two Docker containers on the same host living in Docker the same bridge network, and I have nftables set up to restrict more or less all traffic (rules below).
My only problem (that I know of) is that traffic from one container to the…
alfonx
- 250
- 5
- 10
1
vote
0 answers
How do debug nft_table allow rule thats contradictory
I have some nftable rules in the inet firewalld table
chain filter_FWD_policy_externalTolxc {
jump filter_FWD_policy_externalTolxc_pre
jump filter_FWD_policy_externalTolxc_log
jump…
user22866
- 151
- 6
1
vote
1 answer
Nft list ruleset with ports
Is there a way to list the actual ports when listing the rules?
I mean:
nft list ruleset
table ip filter {
chain INPUT {
type filter hook input priority 0; policy drop;
iifname "lo" counter packets 114 bytes 316154 accept
…
Arany Péter
- 112
- 1
- 6
1
vote
0 answers
Docker Compose containers cannot communicate through nftables
I just have a quick question about Docker Compose.
I have a Nftables firewall installed on my server and regarding the input and forward chain the default drop policy loaded.
Until now everything has always worked but today I wanted to install the…
Jonathan
- 43
- 6