Questions tagged as ['nftables']

I want to do the equivalent of

iptables -t nat -A POSTROUTING -m ipvs --vaddr 1.2.3.4 -j MASQUERADE

in nftables. The nftables wiki says ipvs is supported, but

add rule ip nat POSTROUTING ipvs vaddr 1.2.3.4 masquerade

does not work. All other variations I have tried do not work either... When I add the rule using iptables and list all rules using nft, I get

vaddr 1.2.3.4 counter packets 0 bytes 0 ma ...

Assuming the following:

||netns2|<-kernel routing-> netnsRoot| <-network routing-> |remote server| 

netns2

• is a network namespace
• has a client that connects to the UDP server on UDP/5060

netnsRoot

• is the root network namespace (IE: typical linux routing)
• has a client that connects to the UDP server on UDP/5060
• Has ip_forward enabled and has a Masquerade rule for netns2

Server

• Onl ...

I have a server in a datacenter which is a Proxmox server. On the server (one of many, they are in a Proxmox cluster) I am hosting various VM's.

Services on the VM's are exposed through iptables (using ufw) natting like the following example:

-A PREROUTING -i eno1 -p tcp -d <public_ip> --dport 21 -j DNAT --to-destination <local_ip>:<port>
-A PREROUTING -i eno1 -p tcp -d <public_ip ...

I have been researching and wasn't able to find a definitive answer to the equivalent of below:

apt install nftables
nft add rule inet filter input ip protocol esp counter accept

in iptables?

Is it as simple as doing this below or is there more to it?

sudo iptables -A INPUT -p 50 -j ACCEPT
sudo iptables -A INPUT -p 51 -j ACCEPT

Thanks

I have the following nftables rule: log prefix "[nftables] output denied1: " ip daddr 34.117.59.81 reject

in syslog i can see the message: [nftables] output denied1: IN= OUT=br0 SRC=10.10.10.1 DST=10.10.10.4 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=540 PROTO=ICMP TYPE=0 CODE=0 ID=2 SEQ=60848

Now i wonder how it is possible? In the syslog message there is DST=10.10.10.4, but the rule shouldn't be used for  ...

We have a problem where we set up a server running a service and it is capable of hundreds of simultaneous connections on port 3535 (arbitrarily assigned for this application). We have firewalld running on this near-end-host allowing connections from the far-end host and that is all working fine. The problem we ran into is the far-end-host is only able to establish a few connections at a time and it i ...

I’m running on Rocky Linux (RHEL8 based) and am kind of struggling with firewalld and iptables. Well, not really iptables anyway… Let me explain.

I setup a K8S cluster on VMWare ESXi with six virtual machines, all the same. I need to have firewalld running, given this environment. I’m using Weave CNI, which is using iptables in order to create its networking rules.

Here are my initial findings: ...

I have an issue with IPv6 on my server. I have nginx configured to listen on port 443 from IPv4 and IPv6. And it works great: my webiste is available form Internet with TLS enabled.

Things get complicated when I activate nftables: when I am accessing my website from IPv4 it works, but when I access it from IPv6 connections time out :(

Output of sudo nft list ruleset:

table inet filter {
        chain INP ...

A Linux box has multiple network interfaces. IP forwarding is enabled for IPv4 and IPv6.

I would like to protect the services running on the router itself via a stateful firewall. For that, connection tracking needs to be enabled. At the same time, I would like to exclude all traffic that is forwarded from one interface to another from connection tracking.

For the stateful firewall, I would typical ...

I'm looking for some help migrating some old iptables rules onto a system that is only using nftables.

iptables rules:

iptables -A INPUT -p tcp -m tcp --dport 22 -m recent --update --seconds 30 --hitcount 10 --name test --mask 255.255.255.255 --rsource -j DROP
iptables -A INPUT -p tcp -m tcp --dport 22 -m recent --set --name test --mask 255.255.255.255 --rsource

The nftables wiki suggests using S ...

I have removed firewalld and installed nftables in CentOS 7 (kernel 3.10.0-1160.42.2.el7.x86_64). My ruleset is as follows:

# nft list ruleset

table ip my_table {
        set ssh_evils {
                type ipv4_addr
        }

        set sip_evils {
                type ipv4_addr
        }

        set dialers {
                type ipv4_addr
        }

        set sip_origins {
                 ...

I have set up some firewall rules using nftables. They include some data counters for some types of traffic that I'm interested to monitor.

Now, I'd like to be able to have an application read those counters, ideally using libnftnl, running as a non-root user. But, initial testing with nft indicates that I can't read nftables counters as a non-root user.

As root:

$ nft list counter my_table my_counter
ta ...

I was trying to make system-resolved as a remote DNS caching server (I know it is not intended to do so). I added the changed the net.ipv4.conf.br0.route_localnet to 1 and added the following nftable rules:

table ip nat {
    chain prerouting {
        type nat hook prerouting priority 100; policy accept;
        iif "br0" udp dport 53 counter packets 6 bytes 366 dnat to 127.0.0.53
    }

    chain ...

I'm setting up TPROXY on my VyOS router to forward certain traffic to a local transparent proxy. It works pretty well, until I discovered that all of my DNAT port forwarding rules are no longer working (connection timeout when connecting from external network).

Environment

• Router: 10.0.0.1/24 (Proxy is running on 1234 port and adding SO_MARK with 0xff)
• Internal Host: 10.0.0.2/24 (Port 80 should be expo ...

System is debian 10 with nftables.
I plan to make nftalbes auto restart when failed,script as below:

cat << EOF >> /etc/systemd/system/nftables.service.d/override.conf
[Service]
Restart=on-failure
RestartSec=1s
EOF

systemctl daemon-reload

Output shows bad-setting:

systemctl status nftables.service

nftables.service - nftables
   Loaded: bad-setting (Reason: Unit nftables.service has  ...

is there iptables target to fragment packets, let say i have packet with length 1280 i want to split this packet into smaller 5 packets with maximum length equal 250 , is it possible to use firewall in linux (nftables, iptables) to fragment packet or is there a way in general ?

can i use virtual interface with maximum mtu of 250 and let it deal with udp connection ? if it possible how to do that

My system is debian 10 with nftables.
output of nethogs as below:

? root     192.168.2.10:59100-172.217.27.138:443 
? root     192.168.2.10:59086-172.217.27.138:443 
? root     192.168.2.10:59082-172.217.27.138:443 
? root     192.168.2.10:59062-172.217.27.138:443 
? root     192.168.2.10:59058-172.217.27.138:443 
? root     192.168.2.10:59054-172.217.27.138:443 
? root     192.168.2.10:59030-172.217. ...

I already disble ipv6 in mypc debian 10 system,firewall is nftable.
When I check /var/log/messages,lots of kernel: [ ] output chain dropped as below:

Jul 13 11:03:14 mypc kernel: [ 8206.745775] output chain dropped: IN= OUT=enp0s31f6 SRC=fe80:0000:0000:0000:cad3:ffff:fe6e:e23b DST=ff02:0000:0000:0000:0000:0000:0000:0002 LEN=48 TC=0 HOPLIMIT=255 FLOWLBL=248793 PROTO=ICMPv6 TYPE=133 CODE=0 UID=0 GID= ...

I am trying to set up a firewall with nftables but I failed to understand and implement a simple rate limit based on the documentation I have found.

• OS : Ubuntu 20.04 LTS
• nftables version : 0.9.3 (Topsy)
• kernel release: 5.8.0-53-generic

I have built the test firewall with the below sequence of commands:

nft 'add table inet testnetwork'
nft 'add chain inet testnetwork INPUT { type filter hook input prior ...

I have the following scenario, with a VPN connecting two companies together there is some overlap in the used private subnets.

So the solution I was trying to achieve is to remap the remote subnets to locally unused subnets.

e.g. 192.168.5.x => 10.100.3.x

There is also the issue with DNS name resolution, yet all remote vpn related DNS entries should be under some common DNS root (like external.examp ...

I'm trying to configure my Gentoo Linux as a router.

this is my configuration so far.

WAN NIC is enp3s0 and LAN NIC is enp1s0f0

accepting connections to ICMP, tcp ports 53, 22, 80, 443, 445, 5900 and udp ports 53,67,68 from LAN

accepting connection from SSH port 22 from WAN

these work great, what I failed to do is create port forwarding.

I am trying to set up that if a connection on port 222 comes in from ...

I have a Raspberry Pi that's connected to a wireless router with wlan0, and there's a server that's connected to the eth0. Both these connections work fine.

The eth0 between Pi and the server is statically configured so that Pi's eth0 has IP 192.168.3.23/24 and the server has IP 192.168.3.200/24. Pi's wlan0 has IP of 192.168.1.131/24.

Now, I'm trying to do forwarding so that when connecting Pi's por ...