mirror of
https://gitea.com/mcereda/oam.git
synced 2026-02-09 05:44:23 +00:00
182 lines
4.4 KiB
Markdown
182 lines
4.4 KiB
Markdown
# nftables
|
|
|
|
Successor to [iptables].<br/>
|
|
Replaces the existing `iptables`, `ip6tables`, `arptables`, and `ebtables` framework.
|
|
|
|
Leverages the Linux kernel, and the newer `nft` userspace command line utility.<br/>
|
|
Provides a compatibility layer for the `iptables` framework.
|
|
|
|
1. [TL;DR](#tldr)
|
|
1. [Further readings](#further-readings)
|
|
1. [Sources](#sources)
|
|
|
|
## TL;DR
|
|
|
|
Built on _rules_ which specify _actions_.<br/>
|
|
Rules are attached to _chains_.<br/>
|
|
Chains can contain a collection of rules, are stored inside _tables_, and are registered in netfilter's hooks.<br/>
|
|
Tables are specific for one of the layer 3 protocols.
|
|
|
|
Differently from [iptables], there are no predefined tables or chains.
|
|
|
|
`nft` supports replacing atomic rules by using `nft -f`.<br/>
|
|
This allows to conveniently manage rules using files.
|
|
|
|
> [!warning]
|
|
> When loading rules with `nft -f`, failures will result in none of the file's rules being loaded.<br/>
|
|
> Calling `nft` repeatedly (in a shell script or similar) will fail on specific rules.
|
|
|
|
<!-- Uncomment if used
|
|
<details>
|
|
<summary>Setup</summary>
|
|
|
|
```sh
|
|
```
|
|
|
|
</details>
|
|
-->
|
|
|
|
<details>
|
|
<summary>Usage</summary>
|
|
|
|
```sh
|
|
# List tables.
|
|
nft list tables
|
|
nft list tables 'family_type'
|
|
|
|
# List all rules.
|
|
nft --handle list ruleset
|
|
nft -a list ruleset
|
|
|
|
# List chains and rules in tables.
|
|
nft list table 'family_type' 'table_name'
|
|
|
|
# List chains.
|
|
nft list chains
|
|
nft list chains 'family_type'
|
|
|
|
# List rules in chains.
|
|
nft list chain 'family_type' 'table_name' 'chain_name'
|
|
|
|
# Dry run commands.
|
|
nft --check …
|
|
nft -c …
|
|
|
|
# Be verbose.
|
|
nft --echo …
|
|
nft -e …
|
|
|
|
# Add chains.
|
|
nft add chain 'family_type' 'table_name' 'chain_name' \
|
|
"{ type 'chain_type' hook 'hook_type' priority 'priority_value' ; policy 'policy' ;}"
|
|
|
|
# Edit chains.
|
|
nft chain 'family_type' 'table_name' 'chain_name' \
|
|
"{ [ type 'chain_type' hook 'hook_type' device 'device_name' priority 'priority_value' ; policy 'policy_type' ; ] }"
|
|
|
|
# Add rules to chains.
|
|
nft add rule 'family_type' 'table_name' 'chain_name' 'handle' 'handle_value' 'statement'
|
|
|
|
# Delete rules.
|
|
nft delete rule inet 'base_table' 'input_filter' handle 3
|
|
|
|
# Clear rules from chains.
|
|
nft flush chain 'family_type' 'table_name' 'chain_name'
|
|
|
|
# Clear rules from tables.
|
|
nft flush table 'family_type' 'table_name'
|
|
|
|
# Delete chains.
|
|
# Chains can *only* be deleted if they contain no rules *and* they are not used as jump targets.
|
|
nft delete chain 'family_type' 'table_name' 'chain_name'
|
|
|
|
# Delete tables.
|
|
nft delete table 'inet' 'net_table'
|
|
|
|
# Remove the whole ruleset.
|
|
# This leaves the system with no firewall.
|
|
nft flush ruleset
|
|
|
|
# Dump the current ruleset.
|
|
nft --stateless list ruleset > '/path/to/nftables.dump'
|
|
nft -s list ruleset > '/path/to/nftables.dump'
|
|
|
|
# Read commands from files.
|
|
nft --file 'path/to/file'
|
|
nft -f 'path/to/file'
|
|
|
|
# Listen to all events.
|
|
# Reports in the native nft format.
|
|
nft monitor
|
|
```
|
|
|
|
</details>
|
|
|
|
<details>
|
|
<summary>Real world use cases</summary>
|
|
|
|
```sh
|
|
# List tables.
|
|
nft list tables
|
|
nft list tables 'ip'
|
|
|
|
# List tables' contents.
|
|
sudo nft list table 'ip' 'filter'
|
|
|
|
# Add tables for the IPv4 and IPv6 layers.
|
|
nft add table 'inet' 'net_table'
|
|
|
|
# Add tables for the ARP layer.
|
|
nft add table 'arp' 'arp_table'
|
|
|
|
# List chains.
|
|
nft list chains
|
|
nft list chains 'ip'
|
|
|
|
# List rules in chains.
|
|
nft list chain 'inet' 'base_table' 'input_filter'
|
|
|
|
# Add a base chain called 'input_filter' to the inet 'base_table' table.
|
|
# Register it to the 'input' hook with priority 0 and type 'filter'.
|
|
nft add chain 'inet' 'base_table' 'input_filter' "{type filter hook input priority 0;}"
|
|
|
|
# Edit chains.
|
|
nft chain 'inet' 'my_table' 'my_input' '{ policy drop ; }'
|
|
|
|
# Add rules to chains.
|
|
nft add rule 'inet' 'base_table' 'input_filter' tcp dport 80 drop
|
|
nft add rule 'ip' 'ssh' 'ssh_chain' tcp dport 22 accept
|
|
nft add rule 'inet' 'filter' 'input' log
|
|
|
|
# Delete chains.
|
|
nft delete chain 'inet' 'base_table' 'input_filter'
|
|
```
|
|
|
|
</details>
|
|
|
|
## Further readings
|
|
|
|
- [`iptables`][iptables]
|
|
- [How to Create Secure Stateful Firewall Rules with nftables on Linux]
|
|
|
|
### Sources
|
|
|
|
- [Gentoo wiki]
|
|
- [Arch wiki]
|
|
|
|
<!--
|
|
Reference
|
|
═╬═Time══
|
|
-->
|
|
|
|
<!-- In-article sections -->
|
|
<!-- Knowledge base -->
|
|
[iptables]: iptables.md
|
|
|
|
<!-- Files -->
|
|
<!-- Upstream -->
|
|
<!-- Others -->
|
|
[Arch wiki]: https://wiki.archlinux.org/title/Nftables
|
|
[Gentoo wiki]: https://wiki.gentoo.org/wiki/Nftables
|
|
[How to Create Secure Stateful Firewall Rules with nftables on Linux]: https://www.pc-freak.net/blog/mastering-stateful-firewall-rules-nftables-ultimate-guide/
|