Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [nftables]

The tag has no usage guidance, but it has a tag wiki.

Filter by
Sorted by
Tagged with
0 votes
0 answers
73 views

How to redirect requests to remote machine to localhost using nftables?

I have the following nftables configuration: [root@localhost andrew]# nft list ruleset table ip nat { chain prerouting { type nat hook prerouting priority dstnat; policy accept; ip ...
andrew cooke's user avatar
0 votes
0 answers
154 views

Full Cone NAT debian nftables

I have a Debian router, and I'd like to set up Full Cone NAT. I'm using nftables and miniupnpd. My current config (Restricted Cone NAT): table inet nat { chain postrouting { type nat hook ...
94230's user avatar
  • 1
0 votes
2 answers
48 views

What determines if a packet should be routed locally or forwarded?

As seen in the diagram, when the Linux kernel receives a packet, it goes through the prerouting chain, and then a routing decision is made on whether to forward it to somewhere else or deliver it to a ...
discape's user avatar
  • 138
1 vote
1 answer
100 views

Masquerading traffic with non-default routing table

I have a network set up as follows: ┌──────┬────────┐ ┌───────────┐ │ │ eno1.1 │ │ Network A │ │ │ ├─┤ │ ┌────...
Jack Wilsdon's user avatar
3 votes
1 answer
498 views

What is the default verdict for nftables rule?

For example: #!/usr/sbin/nft -f add table ip filter_4 add chain ip filter_4 input { type filter hook input priority filter; policy drop; } add chain ip filter_4 new_in_4 { comment "New ...
metablaster's user avatar
0 votes
1 answer
349 views

Adding regular chain to nftables "Operation not supported"

Syntax to add regular chain to nftables is: add chain [family] <table_name> <chain_name> [{ [policy <policy> ;] [comment "text comment about this chain" ;] }] I run the ...
metablaster's user avatar
0 votes
0 answers
65 views

nftables config for ipsec (strongswan) vpn

If have got a working IPSec connection between a device (raspberry) on remote side (10.X.117.0/24 network) and the local network (10.Y.0.0/16 network). The raspberry has a static 10.X.117.1 IP on its ...
LeifSec's user avatar
  • 73
0 votes
1 answer
229 views

Internet connection activ only after restart of nftables

I configured a DIY Debian-based router without DHCP and DNS server. MY PROBLEM: When I switch on the router and the system boots, the Internet connection on clients becomes available for 4 -5seconds (...
Black's user avatar
  • 1
0 votes
1 answer
313 views

DIY minimal install debian nftables routing not working

I'm trying to build a router on Debian OS and PC-hardware with several network interfaces. Installed minimal debian-12.2.0-amd64 and trying to implement routing between init7_WAN and Carbon_LAN. But I ...
Black's user avatar
  • 1
1 vote
1 answer
47 views

Do forward, but deny direct incoming connections

VM = Virtual Machine. WS = Workstation VM. GW = Gateway VM. Virtualization software: Oracle VirtualBox. Host/Guest OSes: all Debian 12. Firewall software: nftables Goal Whonix-like setup. WS sits ...
EmErAJID's user avatar
1 vote
0 answers
338 views

redirect local requests to ip to other ip (linux - e.g. debian >= 10)

I want to all request to a certain IP:port on the machine A its self (for a current or rather 10/11/12) to another IP = machine B so that requests from processes on machine A are forwarded to machine ...
LeifSec's user avatar
  • 73
0 votes
1 answer
250 views

Need help using nftables to drop SNMP packets containing a specific community string

I am trying to use nftables [v1.0.2 (Lester Gooch)] to drop SNMP packets containing the community string 'pawan'. I am trying to use the nftables payload expressions - raw payload expression to match ...
Pa1's user avatar
  • 101
0 votes
1 answer
92 views

How do I get data from weather.gov through my nftables firewall?

I'm writing a python script that grabs data from weather.gov (the NDFD SOAP service and current observations XML) to draw a screensaver picture. The script works on my regular computer but not on my ...
Alfalfa Scout's user avatar
1 vote
1 answer
688 views

How to bypass the vpn tunnel for a single docker container using nftables?

I am trying to come up with a solution to bypass the vpn tunnel in the incoming and outgoing docker container. The VPN I'm using is Mullvad VPN and in the split tunneling section they have addressed ...
Farhood ET's user avatar
5 votes
1 answer
2k views

How does one create nftables rule that accepts connections from the same IPv6 subnet, when the IPv6 prefix is dynamic?

For IPv4, it is easy to create a rule that only accepts connections from hosts of the same subnet, for example (assuming my computer is 192.168.42.2, and the incoming connection is 192.168.42.20): ...
Haden's user avatar
  • 53
4 votes
1 answer
1k views

nftables: How to stop further chain traversal after accept verdict

Context : https://wiki.nftables.org/wiki-nftables/index.php/Configuring_chains If a packet is accepted and there is another chain, bearing the same hook type and with a later priority, then the packet ...
tushars's user avatar
  • 41
0 votes
0 answers
613 views

Using iptables-nft/ebtables-nft to intercept specific forwarded/bridged IP packets on a bridge and redirect them to the bridge device itself

With a bridge br0 using eth0 and wlan0 as bridge ports, formerly one could intercept packets arriving on a bridge port with iptables -t mangle -A PREROUTING -m physdev --physdev-in wlan0 --protocol ...
dom's user avatar
  • 1
1 vote
1 answer
342 views

nftables, dnat in output chain appears to be done after routing

I have an EC2 instance and an application that requires to send to the EIP from within the instance. I am trying to configure a dnat on the output chain so that the packets dont go out to the internet ...
user6072865's user avatar
0 votes
0 answers
53 views

Forwarded packet seemingly, skipping POSTROUTING rules

I have a very simple Wireguard configuration. Client are assigned 10.7.0.0/24 addressed, traffic is forwarded out the primary interface, finally the packets are SNAT'd out of the primary interface on '...
Liam Kelly's user avatar
0 votes
1 answer
1k views

Configuring nftable firewall for one way packet traffic

Hello I'm a beginner in configuring firewall, but what I want to do is to allow the host a (10.1.0.2) to send packet to host b (10.12.0.10) but that b cannot send packet to a. both machine are ...
Tiklyt's user avatar
  • 13
0 votes
1 answer
472 views

nftables: isolate VLANs with some exceptions

Say there is a custom router (a Raspberry Pi box) with Debian 11 and nftables installed, with a single physical Ethernet inferface and the following VLANs configured: eth0.501 192.168.41.0/24 CCTV ...
Greendrake's user avatar
0 votes
1 answer
48 views

nft_pipapo_avx2_scratch_index shows up on all my perf recordings

I'm investigating a performance issue on my Ubuntu 22.04.2 LTS machine. I take the following steps: sudo perf record -g -F max -s --call-graph dwarf -e cycles -e sched:sched_switch --switch-events --...
Martijn Courteaux's user avatar
0 votes
1 answer
234 views

nftables: usage ct label set in

Using in statefull mode, I collect information about the amount of packages/bytes from the rules and do not create the rules for returning packages because they are accepted based on the states stored ...
user avatar
0 votes
0 answers
151 views

What is the l4proto carp counter in nftables?

I was converting my iptables rules to nbtables and the script produced a few errors. One of them was: add rule ip6 mangle protos_check meta l4proto carp counter return which was translated from -A ...
Josh Matthews's user avatar
0 votes
0 answers
94 views

Nftables exits with "Killed" when trying to update a set with a huge list of ips

I have a huge list of IPs (about 300 000) I want to put into a nftables set (to use with pbr on openwrt). Currently what I am doing is directly executing add element with all the IPs, but nftables ...
maximxls's user avatar
0 votes
0 answers
351 views

Using nftables maps

I have a wireguard network in which I want a "host" peer to forward some traffic to multiple network cameras in its local network. Said peer registers several IPs, and I want to use nftables ...
zorael's user avatar
  • 1
0 votes
0 answers
2k views

Allow DNS traffic using Nftables

I tried the following commands but it still doesn't allow DNS traffic. What am I doing wrong? nft add table inet tarffic nft add chain inet traffic INPUT '{ type filter hook input priority 100; policy ...
1ID's user avatar
  • 1
1 vote
1 answer
1k views

How to ban <SUBNET> with fail2ban and nftables

I have Debian 10, Fail2Ban v0.10.6 with iptables and my filter with <SUBNET> works. Now I have Ubuntu 22.04, Fail2Ban v0.11.2 and I try to make it works with nftables. I added only jail.local ...
vvkatwss vvkatwss's user avatar
1 vote
1 answer
276 views

Linux conntrack not seeing multicast responses as part of the same flow

My tv (192.168.1.48) is multicasting an SSDP packet (to 239.255.255.250:1900), and on my server (192.168.1.17), by running smcroute and doing some packet mangling to increase the IP TTL of this ...
j0057's user avatar
  • 240
0 votes
0 answers
493 views

How can I use the WAN interface IP address(es) in NFTables config?

Background I'm attempting to write an NFTables configuration that would allow me to keep IPv4 and IPv6 forwarding rules in the same table. I'm hosting some web services behind a reverse proxy and want ...
Mikael H's user avatar
  • 136
1 vote
1 answer
1k views

How to allow traffic over VPN across namespaces using nftables

I have a wireguard interface configured in a dedicated namespace vpn. It is configured first creating the interface in the main namespace (that has access to the physical interface routing to the ...
rdbisme's user avatar
  • 420
0 votes
0 answers
488 views

nftables or fw4 issue with timebased traffic rules

Since the OpenWRT ver > 22.3 does use NFTABLES instead of IPTABLES I got issue with some firewall (fw4) time based traffic rules that I have no idea how to solve them. The firewall rule is as ...
Sina S.'s user avatar
0 votes
1 answer
2k views

nftables: IPv6 NAT packets not going into forward chain but returned destination unreachable

I'm setting up NAT for IPv6 on an OpenWrt (22.03.0-rc4) router because my ISP only allocates one single IPv6 address via DHCPv6, and only allows one MAC address to use a single IPv6 address obtained ...
Charlie Jiang's user avatar
1 vote
0 answers
3k views

How to stop the sending of ICMP timestamps replies and requests?

Woo, progress! Updated below! I've been all over the internet looking for an answer to this one. I am using a Raspberry Pi running Raspbian Debian 11. The problem seems rather simple, just blocking ...
SuperDialga's user avatar
3 votes
1 answer
2k views

nftables: How to get BROUTING behavior like ebtables legacy?

In ebtables, BROUTING chain in broute table has special behaviors for ACCEPT and DROP actions: ACCEPT means bridging/forward path and DROP means routing/input path. For example, to force all non-IPv6 ...
Charlie Jiang's user avatar
0 votes
0 answers
266 views

nftables rules syantax getting error in adding rule

I am trying to add this rule nft insert rule ip nat PREROUTING iifname enp0s3 udp dport 9100 counter dnat to 192.168.150.2 I am getting this error [root@ph3ro]# nft insert rule ip nat PREROUTING ...
ph3ro's user avatar
  • 143
2 votes
1 answer
948 views

How to redirect traffic from container A to container B when using the address of the external interface

Following a short/simplified diagram of my setup (sorry for the title): Internet ----- eth0 (1.2.3.4) --- br0 (10.0.0.1) | +---------------+-...
mageta's user avatar
  • 151
0 votes
0 answers
866 views

How to do "source-MAC based routing" with nftables

(This is a simplified version of this: Can Linux do "source MAC based routing?") I have an appliance that needs to route egress packets back to the MAC interface where the ingress packets ...
Rusty Lemur's user avatar
1 vote
2 answers
373 views

Nftables firewall rule hex value 0x1fff changed to decimal 8191

I started the process of migrating into nftables, just noticed that while I add this rule add rule netdev filter INGRESS ip frag-off & 0x1fff != 0 counter drop should look like this in nftables....
Nikosis's user avatar
  • 13
1 vote
0 answers
2k views

iptables to nftables for iKEv2 IPSEC VPN server

Can someone please help in converting the below iptable rules to equivalent nftables rules? I have already tried to use iptables-translate, but it is not translating all of my rules... # accept ports ...
user2837961's user avatar
2 votes
1 answer
2k views

How do I make a stateful bridge filewall with nftables?

The nftables wiki has an example, but it doesn't seem to work for me. The page says that it should work since kernel 5.3, but it says "protocol error" when I try the exact commands from the ...
Thomas's user avatar
  • 579
0 votes
1 answer
1k views

Translate WireGuard config from iptables to nft

I was installing WireGuard on a fresh Raspberry Pi OS image and wanted to move the server config from another device onto this. But bringing up the interface said it can't find the iptables command. ...
ygoe's user avatar
  • 2,318
0 votes
0 answers
247 views

nftables disables/disconnects wifi interfaces

I am trying to switch to nftables to set up some port forwarding. But when I enable the nftables service, it disables my wifi connection. Attempting to connect to an access point, I get Error: ...
Dan Jenson's user avatar
0 votes
1 answer
385 views

NFTABLE issue: IPv6 does not behave like IPv4 with mirror config

I have an issue with IPv6 on my server. I have nginx configured to listen on port 443 from IPv4 and IPv6. And it works great: my webiste is available form Internet with TLS enabled. Things get ...
Ricain's user avatar
  • 156
3 votes
1 answer
650 views

Linux: only allow outgoing connections to specific domains

I have a CentOS server and only want to allow outgoing connections to specific domains. (allowlist) My thought was to have a DNS proxy which adds the allowed ips (only ipv4 needed) to nftable named ...
Alai's user avatar
  • 73
1 vote
1 answer
1k views

multihomed inbound natting using nftables

i have a multihomed router with two external IPs. I would like to NAT incoming connections from both IPs to the same internal IP. What I have so far $ ip rule show 0: from all lookup local 32761: ...
Aleksandar Ivanisevic's user avatar
0 votes
1 answer
409 views

nftables on Debian: router advertisments are not processed

I want to filter IPv6 packets on a Debian host using nftables. In the "table ip6 filter" section in "chain input" I use icmpv6 type {echo-request,nd-neighbor-solicit,nd-router-...
Michael Kremser's user avatar
2 votes
0 answers
1k views

Should I allow IGMP traffic on my workstation, home server or a hosted VPS?

I'm new to firewall configuration and I've been reading some theory and studying example configurations. One thing that I noticed is that many of those examples allow IGMP packets. The Wikipedia ...
Igor Bubelov's user avatar
1 vote
0 answers
775 views

500 Server Error: Internal Server Error with Kathara, Docker and iptables/nftables

I want to use Kathara via "kathara lstart" but I get a 500 Server Error: Internal Server Error and I don't understand why. I'm using Docker (Preview version for Apple M1). I don't know if ...
Salim's user avatar
  • 11
0 votes
1 answer
2k views

nftables 1:1 NAT (ip address to ip address)

Upgraded to Fedora 32 which uses nftables which I am entirely unfamiliar and after perusing all documentation I could find, I can not figure out how to replicate my 1:1 NAT with nftables which means ...
Ars Dementis's user avatar