nftables

nftables#

nftables (netfilter tables) is the successor to iptables. It replaces iptables, ip6tables, arptables, and ebtables with a single framework.

Tables#

  • ip, IPv4 chains.

  • ip6, IPv6 chains.

  • arp, ARP chains.

  • bridge, bridging chains.

  • inet, mixed IPv4 / IPv6 chains.

Chains#

  • filter, filtering packets.

  • route, rerouting packets.

  • nat, Network Address Translation.

Hooks#

  • prerouting, before routing, all packets entering the machine.

  • input, packets for the local system.

  • forward, forwarded packets.

  • output, packets originating from the local system.

  • postrouting, after routing, all packets leaving the machine.

Rules#

Protocols, ip, ip6, tcp, udp, udplite, sctp, dccp, ah, esp, ipcomp, icmp, icmpv6, ct (conntrack), meta (packet metadata).

Statements#

  • accept, accept the packet and stop ruleset evaluation.

  • drop, drop the packet and stop evaluation.

  • reject, reject with an ICMP message.

  • queue, queue to userspace and stop evaluation.

  • continue.

  • return, return from the current chain.

  • jump <chain>, jump to a chain.

  • goto <chain>, like jump but does not return.

Setup#

$ nft -f files/nftables/ipv4-filter            # initial setup with provided ipv4-filter
$ nft list table filter                        # list resulting chain

Basic rules handling#

# Drop output to destination
$ nft add rule ip filter output ip daddr 1.2.3.4 drop

# With counter (must be set explicitly)
$ nft add rule ip filter output ip daddr 1.2.3.4 counter drop

# Network
$ nft add rule ip filter output ip daddr 192.168.1.0/24 counter

# Drop to port 80
$ nft add rule ip filter input tcp dport 80 drop

# Accept ICMP echo
$ nft add rule filter input icmp type echo-request accept

# Combine filtering
$ nft add rule ip filter output ip protocol icmp ip daddr 1.2.3.4 counter drop

# Delete all rules in a chain
$ nft delete rule filter output

# Delete a specific rule (get handle with -a)
$ nft list table filter -a
$ nft delete rule filter output handle 10

# Flush the table
$ nft flush table filter

# Insert a rule
$ nft insert rule filter input tcp dport 80 counter accept

# Insert at a specific position
$ nft add rule filter output position 8 ip daddr 127.0.0.8 drop
$ nft insert rule filter output position 8 ip daddr 127.0.0.12 drop

# Match filter on protocol
$ nft insert rule filter output ip protocol tcp counter

IPv6#

$ nft -f files/nftables/ipv6-filter
$ nft add rule ip6 filter output ip6 daddr home.regit.org counter
$ nft list table ip6 filter

# Accept dynamic IPv6 config and neighbor discovery
$ nft add rule ip6 filter input icmpv6 type nd-neighbor-solicit accept
$ nft add rule ip6 filter input icmpv6 type nd-router-advert accept

Conntrack and interface#

# Established connections
$ nft insert rule filter input ct state established accept

# Loopback out
$ nft insert rule filter output oif lo accept

# Incoming on eth2
$ nft insert rule filter input iif eth2 accept

References#

Contents