Commands¶
Display Rulesets¶
nft list ruleset
Write Active Configuration¶
nft list ruleset > /etc/nftables.conf
Apply Configuration from a File¶
nft -f <<filename>>
Show Existing Tables¶
nft list tables
Add a Rule¶
nft add rule inet filter input ip daddr 127.0.0.8 drop
Delete a Rule¶
First find the handle:
nft --handle --numeric list chain inet filter input
Then delete the corresponding handle
nft delete rule inet filter input handle 21
Ubuntu 18.04¶
apt install nftables
Configuration file:
/etc/nftables.conf
OpenWrt¶
https://openwrt.org/docs/guide-user/firewall/misc/nftables
You can also use nftables on OpenWrt, however you must then manage the rules via the command line without UCI.
- opkg remove iptables kmod-ipt-conntrack kmod-ipt-core kmod-ipt-nat kmod-ipt-offload kmod-iptunnel6
- opkg install kmod-nft-arp kmod-nft-bridge kmod-nft-core kmod-nft-nat kmod-nft-nat6 kmod-nft-netdev kmod-nft-offload
Example Configuration¶
# Variables
define ipv6_ofden = 2001:1234:1234:1b::/64
define ipv6_rx = 2a00:1234:0:108::/64
define ipv6_trusted = { $ipv6_ofden, $ipv6_rx }
define port_ssh_local = 58081
define port_rocketchat = 3000
table inet filter {
chain inputtrusted {
type filter hook input priority 0; policy accept;
}
chain input {
type filter hook input priority 0; policy drop;
# STATES
ct state established,related accept
ct state invalid drop
# Input Interface
iif "lo" accept
# Generals
icmpv6 type { destination-unreachable, echo-request, packet-too-big, time-exceeded, parameter-problem, mld-listener-query, mld-listener-report, mld-listener-done, nd-router-solicit, d-router-advert, nd-neighbor-solicit, nd-neighbor-advert, ind-neighbor-solicit, ind-neighbor-advert, mld2-listener-report } accept
icmp type { echo-request, destination-unreachable, router-advertisement, router-solicitation, time-exceeded, parameter-problem } accept
ip protocol igmp accept
# Allow Incoming http Traffic
tcp dport { http, https } accept
# Allow Incoming RocketChat Traffic
tcp dport { $port_rocketchat } accept
# SSH alternative Port
tcp dport { $port_ssh_local } accept
# doesn't work
ip6 saddr $ipv6_trusted accept
}
chain forward {
type filter hook forward priority 0; policy drop;
}
chain output {
type filter hook output priority 0; policy accept;
}
}