[{"data":1,"prerenderedAt":465},["ShallowReactive",2],{"i-lucide:sun-moon":3,"i-lucide:menu":8,"post-\u002Fblog\u002F2022-10-15-using-nft":10,"surround-\u002Fblog\u002F2022-10-15-using-nft":448,"i-lucide:arrow-left":459,"i-lucide:sparkles":461,"i-lucide:user":463},{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":7},0,24,false,"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 2v2m2.837 12.385a6 6 0 1 1-7.223-7.222c.624-.147.97.66.715 1.248a4 4 0 0 0 5.26 5.259c.589-.255 1.396.09 1.248.715M16 12a4 4 0 0 0-4-4m7-3l-1.256 1.256M20 12h2\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":9},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 5h16M4 12h16M4 19h16\"\u002F>",{"id":11,"title":12,"authors":13,"body":16,"date":433,"description":22,"extension":434,"meta":435,"navigation":438,"path":439,"seo":440,"stem":441,"tags":442,"toc":438,"__hash__":447},"blog\u002Fblog\u002F2022-10-15-using-nft.md","Using Linux nftables",[14,15],"gpt","pfarmer",{"type":17,"value":18,"toc":425},"minimark",[19,23,28,31,34,63,66,70,73,101,108,112,131,138,163,173,216,219,223,226,231,262,267,295,300,328,333,366,369,373,376,398,401,415,418,421],[20,21,22],"p",{},"nftables is the new packet filtering framework built into the Linux kernel that replaces the older iptables technology. This tutorial will cover the basics of using nftables to configure a simple firewall on a Linux system.",[24,25,27],"h2",{"id":26},"installing-nftables","Installing nftables",[20,29,30],{},"Most modern Linux distributions already have nftables installed and enabled by default.",[20,32,33],{},"On Debian\u002FUbuntu systems, you can install it with:",[35,36,41],"pre",{"className":37,"code":38,"language":39,"meta":40,"style":40},"language-shell shiki shiki-themes github-light github-dark-default","sudo apt install nftables\n","shell","",[42,43,44],"code",{"__ignoreMap":40},[45,46,49,53,57,60],"span",{"class":47,"line":48},"line",1,[45,50,52],{"class":51},"sYRkA","sudo",[45,54,56],{"class":55},"sNbzA"," apt",[45,58,59],{"class":55}," install",[45,61,62],{"class":55}," nftables\n",[20,64,65],{},"This will install the nft command line utility we will use to interact with nftables.",[24,67,69],{"id":68},"nft-command-syntax","nft Command Syntax",[20,71,72],{},"The nft command allows us to add, delete, and list rules and sets for packet filtering. Some common syntax includes:",[74,75,76,83,89,95],"ul",{},[77,78,79,82],"li",{},[42,80,81],{},"nft list ruleset"," - List all tables and chains",[77,84,85,88],{},[42,86,87],{},"nft list table \u003Ctable>"," - List all chains in a specific table",[77,90,91,94],{},[42,92,93],{},"nft add rule \u003Ctable> \u003Cchain> \u003Crulespec>"," - Append a rule to a chain",[77,96,97,100],{},[42,98,99],{},"nft delete rule \u003Ctable> \u003Cchain> \u003Chandle>"," - Delete a specific rule",[20,102,103,104,107],{},"The ",[42,105,106],{},"\u003Crulespec>"," defines the matching criteria and actions for packets.",[24,109,111],{"id":110},"creating-custom-chains","Creating Custom Chains",[20,113,114,115,118,119,122,123,126,127,130],{},"By default nftables includes some built-in tables like ",[42,116,117],{},"filter"," which contains chains like ",[42,120,121],{},"input",", ",[42,124,125],{},"output",", and ",[42,128,129],{},"forward",".",[20,132,133,134,137],{},"We can create custom chains under these tables using the ",[42,135,136],{},"add chain"," command:",[35,139,141],{"className":37,"code":140,"language":39,"meta":40,"style":40},"nft add chain filter input my_chain\n",[42,142,143],{"__ignoreMap":40},[45,144,145,148,151,154,157,160],{"class":47,"line":48},[45,146,147],{"class":51},"nft",[45,149,150],{"class":55}," add",[45,152,153],{"class":55}," chain",[45,155,156],{"class":55}," filter",[45,158,159],{"class":55}," input",[45,161,162],{"class":55}," my_chain\n",[20,164,165,166,169,170,172],{},"This adds a new chain called ",[42,167,168],{},"my_chain"," under the ",[42,171,121],{}," table. We can now add rules to this chain:",[35,174,176],{"className":37,"code":175,"language":39,"meta":40,"style":40},"nft add rule filter input my_chain tcp dport { 22, 80 } accept\n",[42,177,178],{"__ignoreMap":40},[45,179,180,182,184,187,189,191,194,197,200,203,206,210,213],{"class":47,"line":48},[45,181,147],{"class":51},[45,183,150],{"class":55},[45,185,186],{"class":55}," rule",[45,188,156],{"class":55},[45,190,159],{"class":55},[45,192,193],{"class":55}," my_chain",[45,195,196],{"class":55}," tcp",[45,198,199],{"class":55}," dport",[45,201,202],{"class":55}," {",[45,204,205],{"class":55}," 22,",[45,207,209],{"class":208},"sPgVT"," 80",[45,211,212],{"class":55}," }",[45,214,215],{"class":55}," accept\n",[20,217,218],{},"This will accept TCP traffic on ports 22 and 80.",[24,220,222],{"id":221},"filtering-packets","Filtering Packets",[20,224,225],{},"nftables provides flexible syntax for matching packets and taking actions. Some examples:",[74,227,228],{},[77,229,230],{},"Match specific IP address",[35,232,234],{"className":37,"code":233,"language":39,"meta":40,"style":40},"nft add rule filter input my_chain ip saddr 192.168.0.5 drop\n",[42,235,236],{"__ignoreMap":40},[45,237,238,240,242,244,246,248,250,253,256,259],{"class":47,"line":48},[45,239,147],{"class":51},[45,241,150],{"class":55},[45,243,186],{"class":55},[45,245,156],{"class":55},[45,247,159],{"class":55},[45,249,193],{"class":55},[45,251,252],{"class":55}," ip",[45,254,255],{"class":55}," saddr",[45,257,258],{"class":208}," 192.168.0.5",[45,260,261],{"class":55}," drop\n",[74,263,264],{},[77,265,266],{},"Match a port range",[35,268,270],{"className":37,"code":269,"language":39,"meta":40,"style":40},"nft add rule filter input my_chain tcp dport {1024-65535} accept\n",[42,271,272],{"__ignoreMap":40},[45,273,274,276,278,280,282,284,286,288,290,293],{"class":47,"line":48},[45,275,147],{"class":51},[45,277,150],{"class":55},[45,279,186],{"class":55},[45,281,156],{"class":55},[45,283,159],{"class":55},[45,285,193],{"class":55},[45,287,196],{"class":55},[45,289,199],{"class":55},[45,291,292],{"class":55}," {1024-65535}",[45,294,215],{"class":55},[74,296,297],{},[77,298,299],{},"Match a network subnet",[35,301,303],{"className":37,"code":302,"language":39,"meta":40,"style":40},"nft add rule filter input my_chain ip saddr 192.168.0.0\u002F24 drop\n",[42,304,305],{"__ignoreMap":40},[45,306,307,309,311,313,315,317,319,321,323,326],{"class":47,"line":48},[45,308,147],{"class":51},[45,310,150],{"class":55},[45,312,186],{"class":55},[45,314,156],{"class":55},[45,316,159],{"class":55},[45,318,193],{"class":55},[45,320,252],{"class":55},[45,322,255],{"class":55},[45,324,325],{"class":55}," 192.168.0.0\u002F24",[45,327,261],{"class":55},[74,329,330],{},[77,331,332],{},"Match by protocol and limit rate",[35,334,336],{"className":37,"code":335,"language":39,"meta":40,"style":40},"nft add rule filter input my_chain icmp limit rate 1\u002Fsecond accept\n",[42,337,338],{"__ignoreMap":40},[45,339,340,342,344,346,348,350,352,355,358,361,364],{"class":47,"line":48},[45,341,147],{"class":51},[45,343,150],{"class":55},[45,345,186],{"class":55},[45,347,156],{"class":55},[45,349,159],{"class":55},[45,351,193],{"class":55},[45,353,354],{"class":55}," icmp",[45,356,357],{"class":55}," limit",[45,359,360],{"class":55}," rate",[45,362,363],{"class":55}," 1\u002Fsecond",[45,365,215],{"class":55},[20,367,368],{},"The nft man pages provide more detail on all the matching criteria and actions available.",[24,370,372],{"id":371},"saving-and-loading-rulesets","Saving and Loading Rulesets",[20,374,375],{},"To persist rules between reboots, we can save our nftables configuration to a file:",[35,377,379],{"className":37,"code":378,"language":39,"meta":40,"style":40},"nft list ruleset > \u002Fetc\u002Fnftables.conf\n",[42,380,381],{"__ignoreMap":40},[45,382,383,385,388,391,395],{"class":47,"line":48},[45,384,147],{"class":51},[45,386,387],{"class":55}," list",[45,389,390],{"class":55}," ruleset",[45,392,394],{"class":393},"sDgYj"," >",[45,396,397],{"class":55}," \u002Fetc\u002Fnftables.conf\n",[20,399,400],{},"This will save the current nftables rules. We can load it on startup by adding:",[35,402,404],{"className":37,"code":403,"language":39,"meta":40,"style":40},"nft -f \u002Fetc\u002Fnftables.conf\n",[42,405,406],{"__ignoreMap":40},[45,407,408,410,413],{"class":47,"line":48},[45,409,147],{"class":51},[45,411,412],{"class":208}," -f",[45,414,397],{"class":55},[20,416,417],{},"to our systemd unit file or init scripts.",[20,419,420],{},"This covers the basics of configuring a simple firewall with nftables on Linux. nftables provides a flexible and powerful framework for packet filtering and firewalling. As iptables is phased out, knowing how to use nftables will become an essential skill for Linux system administration.",[422,423,424],"style",{},"html pre.shiki code .sYRkA, html code.shiki .sYRkA{--shiki-default:#6F42C1;--shiki-dark:#FFA657}html pre.shiki code .sNbzA, html code.shiki .sNbzA{--shiki-default:#032F62;--shiki-dark:#A5D6FF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sPgVT, html code.shiki .sPgVT{--shiki-default:#005CC5;--shiki-dark:#79C0FF}html pre.shiki code .sDgYj, html code.shiki .sDgYj{--shiki-default:#D73A49;--shiki-dark:#FF7B72}",{"title":40,"searchDepth":426,"depth":426,"links":427},2,[428,429,430,431,432],{"id":26,"depth":426,"text":27},{"id":68,"depth":426,"text":69},{"id":110,"depth":426,"text":111},{"id":221,"depth":426,"text":222},{"id":371,"depth":426,"text":372},"2022-10-15","md",{"type":436,"layout":437},"post","blog_page",true,"\u002Fblog\u002F2022-10-15-using-nft",{"title":12,"description":22},"blog\u002F2022-10-15-using-nft",[443,444,445,446],"debian","sysadmin","devops","linux","qL9miTXHs11nOYmIoM5CeRkHOdYhxq8lkq8BEGsX8eE",[449,454],{"title":450,"path":451,"stem":452,"date":453,"children":-1},"Using Python argparse","\u002Fblog\u002F2022-10-01-using-python-argparse","blog\u002F2022-10-01-using-python-argparse","2022-10-01",{"title":455,"path":456,"stem":457,"date":458,"children":-1},"Using Python logging","\u002Fblog\u002F2022-11-03-python-logging","blog\u002F2022-11-03-python-logging","2022-11-03",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":460},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m12 19l-7-7l7-7m7 7H5\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":462},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M11.017 2.814a1 1 0 0 1 1.966 0l1.051 5.558a2 2 0 0 0 1.594 1.594l5.558 1.051a1 1 0 0 1 0 1.966l-5.558 1.051a2 2 0 0 0-1.594 1.594l-1.051 5.558a1 1 0 0 1-1.966 0l-1.051-5.558a2 2 0 0 0-1.594-1.594l-5.558-1.051a1 1 0 0 1 0-1.966l5.558-1.051a2 2 0 0 0 1.594-1.594zM20 2v4m2-2h-4\"\u002F>\u003Ccircle cx=\"4\" cy=\"20\" r=\"2\"\u002F>\u003C\u002Fg>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":464},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M19 21v-2a4 4 0 0 0-4-4H9a4 4 0 0 0-4 4v2\"\u002F>\u003Ccircle cx=\"12\" cy=\"7\" r=\"4\"\u002F>\u003C\u002Fg>",1783616167061]