Nftables old shit: Unterschied zwischen den Versionen

Aus Xinux Wiki
Zur Navigation springen Zur Suche springen
(Die Seite wurde neu angelegt: „ *Nftabels Grundlagen *Nftables Filter =Install= *apt-get install nftables =Create a basic IPv4 table= *nft add table inet filter =List that table= *n…“)
 
 
Zeile 32: Zeile 32:
 
*nft add rule filter forward  iifname "ens19" oifname "ens18" tcp dport 22 counter accept
 
*nft add rule filter forward  iifname "ens19" oifname "ens18" tcp dport 22 counter accept
 
*nft add rule filter forward  iifname "ens19" oifname "ens18" tcp dport 443 counter accept
 
*nft add rule filter forward  iifname "ens19" oifname "ens18" tcp dport 443 counter accept
−
 
−
=Example Script=
 
−
<pre>
 
−
#!/usr/sbin/nft -f
 
−
#variable declration
 
−
define tcp_lan_input_ports = { 8472, 53 }
 
−
define tcp_all_input_ports = { 80, 443 }
 
−
define udp_lan_input_ports = { 53 }
 
−
define tcp_for_input_ports = { 53 }
 
−
define udp_for_input_ports = {  53 }
 
−
 
−
# table declaration
 
−
#
 
−
add table filter
 
−
add table nat
 
−
flush table filter
 
−
flush table nat
 
−
 
−
table filter {
 
−
        chain input {
 
−
                type filter hook input priority 0; policy drop;
 
−
                ct state established,related counter packets 97 bytes 6640 accept
 
−
                iifname "lo" counter accept
 
−
                iifname "ens19" tcp dport $tcp_lan_input_ports counter accept
 
−
                tcp dport $tcp_all_input_ports  counter accept
 
−
                udp dport $udp_lan_input_ports  counter accept
 
−
                log prefix "nft-input "
 
−
        }
 
−
 
−
        chain output {
 
−
                type filter hook output priority 0; policy drop;
 
−
                ct state established,related counter accept
 
−
                counter accept
 
−
                log prefix "nft-output "
 
−
        }
 
−
 
−
        chain forward {
 
−
                type filter hook forward priority 0; policy drop;
 
−
                ct state established,related counter accept
 
−
                iifname "ens19" oifname "ens19" counter accept
 
−
                iifname "ens19" oifname "ens18" tcp dport $tcp_for_input_ports counter accept
 
−
                iifname "ens19" oifname "ens18" udp dport $udp_for_input_ports counter accept
 
−
                iifname "ens19" oifname "ens18" icmp type echo-request counter accept
 
−
                log prefix "nft-forward "
 
−
        }
 
−
}
 
−
 
−
table ip nat {
 
−
      chain prerouting {
 
−
                  type nat hook prerouting priority 0;
 
−
    }
 
−
      chain postrouting {
 
−
                  type nat hook postrouting priority 0;
 
−
                  ip saddr 10.83.33.0/24 oif ens18 snat 10.84.252.33
 
−
 
−
      }
 
−
}
 
−
                                                                                                                  1,1          Top
 
−
</pre>
 
  
 
=List that table=
 
=List that table=

Aktuelle Version vom 17. Januar 2023, 16:36 Uhr

Install

  • apt-get install nftables

Create a basic IPv4 table

  • nft add table inet filter

List that table

  • nft list table inet filter
table inet filter {
}

Create a chain for input,output,forward traffic IPv4

  • nft add chain inet filter input { type filter hook input priority 0\; }
  • nft add chain inet filter output { type filter hook output priority 0\; }
  • nft add chain inet filter forward { type filter hook forward priority 0\; }

Conntracking for input,output,forward

  • nft add rule filter input ct state established,related counter accept
  • nft add rule filter output ct state established,related counter accept
  • nft add rule filter forward ct state established,related counter accept

loopback interface traffic is ok

  • nft add rule filter input iifname "lo" counter accept
  • nft add rule filter output oifname "lo" counter accept

A rule to check that ssh,http,https input is fine (IPv4)

  • nft add rule filter input tcp dport 22 counter accept
  • nft add rule filter input tcp dport 80 counter accept
  • nft add rule filter input tcp dport 443 counter accept

A rule to check that output is fine (IPv4)

  • nft add rule filter output counter accept

A rule to check that some forward is fine (IPv4)

  • nft add rule filter forward iifname "ens19" oifname "ens18" tcp dport 22 counter accept
  • nft add rule filter forward iifname "ens19" oifname "ens18" tcp dport 443 counter accept

List that table

  • nft list table inet filter

Flush rules in chain filter/input

  • nft flush chain inet filter input

Delete the chain filter/input

  • nft delete chain inet filter input

Delete the table filter

  • nft delete table inet filter

Links

Abgerufen von „http://wiki.ixheim.de/index.php?title=Nftables_old_shit&oldid=40051“