Configuring firewalls and packet filters Red Hat Enterprise Linux 9 Managing the firewalld service, the nftables framework, and XDP packet filtering features Red Hat Customer Content Services

Commands:
<?xml version="1.0" encoding="utf-8"?> <zone> <short>My Zone</short> <description>Here you can describe the characteristic features of the zone.</description> <service name="ssh"/> <port protocol="udp" port="1025-65535"/> <port protocol="tcp" port="1025-65535"/> </zone>
firewall-cmd --get-zones
firewall-cmd --add-service=ssh --zone= <your_chosen_zone> firewall-cmd --remove-service=ftp --zone= <same_chosen_zone>
firewall-cmd --get-active-zones
firewall-cmd --zone= <your_chosen_zone> --change-interface=< interface_name > --permanent
firewall-cmd --zone= <your_chosen_zone> --list-all
firewall-cmd --get-default-zone
firewall-cmd --set-default-zone <zone_name >
firewall-cmd --get-active-zones
firewall-cmd --zone= zone_name --change-interface= interface_name --permanent
nmcli connection modify profile connection.zone zone_name
nmcli connection up profile
nmcli -f NAME,FILENAME connection NAME FILENAME enp1s0 /etc/NetworkManager/system-connections/enp1s0.nmconnection enp7s0 /etc/sysconfig/network-scripts/ifcfg-enp7s0
[connection] zone=internal
ZONE=internal
nmcli connection reload
nmcli connection up <profile_name>
firewall-cmd --get-zone-of-interface enp1s0 internal
firewall-cmd --permanent --new-zone= zone-name
firewall-cmd --reload
firewall-cmd --get-zones --permanent
firewall-cmd --zone= zone-name --list-all
firewall-cmd --permanent --zone=zone-name --set-target=<default|ACCEPT|REJECT|DROP>
firewall-cmd --list-services ssh dhcpv6-client
firewall-cmd --get-services RH-Satellite-6 amanda-client amanda-k5-client bacula bacula-client bitcoin bitcoin-rpc bitcoin-testnet bitcoin-testnet-rpc ceph ceph-mon cfengine condor-collector ctdb dhcp dhcpv6 dhcpv6-client dns docker-registry
firewall-cmd --add-service= <service_name>
firewall-cmd --runtime-to-permanent
firewall-cmd --list-all --permanent public target: default icmp-block-inversion: no interfaces: sources: services: cockpit dhcpv6-client ssh ports: protocols: forward: no masquerade: no forward-ports: source-ports: icmp-blocks: rich rules:
firewall-cmd --check-config success
firewall-cmd --check-config Error: INVALID_PROTOCOL: 'public.xml': 'tcpx' not from {'tcp'|'udp'|'sctp'|'dccp'}
firewall-cmd --get-active-zones
firewall-cmd --zone= <zone_name> --add-service=https --permanent
firewall-cmd --reload
firewall-cmd --zone= <zone_name> --list-all
firewall-cmd --zone= <zone_name> --list-services
firewall-cmd --list-ports
firewall-cmd --remove-port=port-number/port-type
firewall-cmd --runtime-to-permanent
firewall-cmd --get-active-zones
firewall-cmd --zone= <zone_to_inspect> --list-ports
firewall-cmd --panic-on
firewall-cmd --panic-off
firewall-cmd --query-panic
firewall-cmd --add-source=<source>
firewall-cmd --zone=zone-name --add-source=<source>
firewall-cmd --get-zones
firewall-cmd --zone=trusted --add-source=192.168.2.15
firewall-cmd --runtime-to-permanent
firewall-cmd --zone=zone-name --list-sources
firewall-cmd --zone=zone-name --remove-source=<source>
firewall-cmd --runtime-to-permanent
firewall-cmd --zone=zone-name --remove-source-port=<port-name>/<tcp|udp|sctp|dccp>
firewall-cmd --get-zones block dmz drop external home internal public trusted work
firewall-cmd --zone=internal --add-source=192.0.2.0/24
firewall-cmd --zone=internal --add-service=http
firewall-cmd --runtime-to-permanent
firewall-cmd --zone=internal --list-all internal (active) target: default icmp-block-inversion: no interfaces: sources: 192.0.2.0/24 services: cockpit dhcpv6-client mdns samba-client ssh http
firewall-cmd --permanent --new-policy myOutputPolicy firewall-cmd --permanent --policy myOutputPolicy --add-ingress-zone HOST firewall-cmd --permanent --policy myOutputPolicy --add-egress-zone ANY
firewall-cmd --permanent --policy mypolicy --set-priority -500
firewall-cmd --permanent --new-policy podmanToAny
firewall-cmd --permanent --policy podmanToAny --set-target REJECT firewall-cmd --permanent --policy podmanToAny --add-service dhcp firewall-cmd --permanent --policy podmanToAny --add-service dns firewall-cmd --permanent --policy podmanToAny --add-service https
firewall-cmd --permanent --new-zone=podman
firewall-cmd --permanent --policy podmanToHost --add-ingress-zone podman
firewall-cmd --permanent --policy podmanToHost --add-egress-zone ANY
systemctl restart firewalld
firewall-cmd --info-policy podmanToAny podmanToAny (active) target: REJECT ingress-zones: podman egress-zones: ANY services: dhcp dns https
firewall-cmd --permanent --policy mypolicy --set-target CONTINUE
firewall-cmd --info-policy mypolicy
firewall-cmd --permanent --new-policy <example_policy>
firewall-cmd --permanent --policy= <example_policy> --add-ingress-zone=HOST firewall-cmd --permanent --policy= <example_policy> --add-egress-zone=ANY
firewall-cmd --permanent --policy= <example_policy> --add-rich-rule='rule family="ipv4" destination address=" 192.0.2.1 " forward-port port=" 443 " protocol="tcp" to-port=" 443 " to-addr=" 192.51.100.20 "'
firewall-cmd --reload success
echo "net.ipv4.conf.all.route_localnet=1" > /etc/sysctl.d/90-enable-route-localnet.conf
sysctl -p /etc/sysctl.d/90-enable-route-localnet.conf
curl https://192.0.2.1:443
sysctl net.ipv4.conf.all.route_localnet net.ipv4.conf.all.route_localnet = 1
firewall-cmd --info-policy= <example_policy> example_policy (active) priority: -1 target: CONTINUE ingress-zones: HOST egress-zones: ANY services: ports: protocols: masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: rule family="ipv4" destination address="192.0.2.1" forward-port port="443" protocol="tcp" to-port="443" to-addr="192.51.100.20"
firewall-cmd --zone= external --query-masquerade
firewall-cmd --zone= external --add-masquerade
firewall-cmd --zone= external --remove-masquerade
net.ipv4.ip_forward=1
sysctl -p /etc/sysctl.d/90-enable-IP-forwarding.conf
firewall-cmd --zone=public --add-forward-port=port=80:proto=tcp:toaddr=198.51.100.10:toport=8080 --permanent
firewall-cmd --reload
firewall-cmd --list-forward-ports --zone=public port=80:proto=tcp:toport=8080:toaddr=198.51.100.10
cat /etc/firewalld/zones/public.xml <?xml version="1.0" encoding="utf-8"?> <zone> <short>Public</short> <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description> <service name="ssh"/> <service name="dhcpv6-client"/> <service name="cockpit"/> <forward-port port="80" protocol="tcp" to-port="8080" to-addr="198.51.100.10"/> <forward/> </zone>
net.ipv4.ip_forward=1
sysctl -p /etc/sysctl.d/90-enable-IP-forwarding.conf
firewall-cmd --zone=public --add-forward-port=port= <standard_port> :proto=tcp:toport= <non_standard_port> --permanent
firewall-cmd --reload
firewall-cmd --list-forward-ports port=8080:proto=tcp:toport=80:toaddr=
cat /etc/firewalld/zones/public.xml <?xml version="1.0" encoding="utf-8"?> <zone> <short>Public</short> <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description> <service name="ssh"/> <service name="dhcpv6-client"/> <service name="cockpit"/> <forward-port port="8080" protocol="tcp" to-port="80"/> <forward/> </zone>
firewall-cmd --get-icmptypes address-unreachable bad-header beyond-scope communication-prohibited destination-unreachable echo-reply echo-request failed-policy fragmentation-needed host-precedence-violation host-prohibited host-redirect host-unknown host-unreachable
firewall-cmd --zone= <target-zone> --remove-icmp-block= echo-request --permanent
firewall-cmd --zone= <target-zone> --add-icmp-block= redirect --permanent
firewall-cmd --reload
firewall-cmd --list-icmp-blocks redirect
firewall-cmd --permanent --new-ipset= allowlist --type=hash:ip
firewall-cmd --permanent --ipset= allowlist --add-entry= 198.51.100.10
firewall-cmd --permanent --zone=public --add-source=ipset: allowlist
firewall-cmd --reload
firewall-cmd --get-ipsets allowlist
firewall-cmd --list-all public (active) target: default icmp-block-inversion: no interfaces: enp0s1 sources: ipset:allowlist services: cockpit dhcpv6-client ssh ports: protocols:
cat /etc/firewalld/ipsets/allowlist.xml <?xml version="1.0" encoding="utf-8"?> <ipset type="hash:ip"> <entry>198.51.100.10</entry> </ipset>
firewall-cmd --add-rich-rule='rule priority=32767 log prefix="UNEXPECTED: " limit value="5/m"'
nft list chain inet firewalld filter_IN_public_post table inet firewalld { chain filter_IN_public_post { log prefix "UNEXPECTED: " limit rate 5/minute } }
firewall-cmd --query-lockdown
firewall-cmd --lockdown-on
firewall-cmd --lockdown-off
<?xml version="1.0" encoding="utf-8"?> <whitelist> <command name="/usr/bin/python3 -s /usr/bin/firewall-config"/> <selinux context="system_u:system_r:NetworkManager_t:s0"/> <selinux context="system_u:system_r:virtd_t:s0-s0:c0.c1023"/> <user id="0"/> </whitelist>
<?xml version="1.0" encoding="utf-8"?> <whitelist> <command name="/usr/libexec/platform-python -s /bin/firewall-cmd*"/> <selinux context="system_u:system_r:NetworkManager_t:s0"/> <user id="815"/> <user name="user"/> </whitelist>
echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf
firewall-cmd --get-active-zones
firewall-cmd --zone=internal --change-interface= interface_name --permanent
firewall-cmd --zone=internal --add-interface=enp1s0 --add-interface=wlp0s20
firewall-cmd --zone=internal --add-forward
ncat -e /usr/bin/cat -l 12345
ncat <other_host> 12345
--- - name: Reset firewalld example hosts: managed-node-01.example.com tasks: - name: Reset firewalld ansible.builtin.include_role: name: rhel-system-roles.firewall vars: firewall: - previous: replaced
ansible-playbook --syntax-check ~/playbook.yml
ansible-playbook ~/playbook.yml
ansible managed-node-01.example.com -m ansible.builtin.command -a 'firewall-cmd --list-all-zones'
--- - name: Configure firewalld hosts: managed-node-01.example.com tasks: - name: Forward incoming traffic on port 8080 to 443 ansible.builtin.include_role: name: rhel-system-roles.firewall vars: firewall: - forward_port: 8080/tcp;443; state: enabled runtime: true permanent: true
ansible-playbook --syntax-check ~/playbook.yml
ansible-playbook ~/playbook.yml
ansible managed-node-01.example.com -m ansible.builtin.command -a 'firewall-cmd --list-forward-ports' managed-node-01.example.com | CHANGED | rc=0 >> port=8080:proto=tcp:toport=443:toaddr=
--- - name: Configure firewalld hosts: managed-node-01.example.com tasks: - name: Creating a DMZ with access to HTTPS port and masquerading for hosts in DMZ ansible.builtin.include_role: name: rhel-system-roles.firewall vars: firewall: - zone: dmz interface: enp1s0 service: https state: enabled runtime: true permanent: true
ansible-playbook --syntax-check ~/playbook.yml
ansible-playbook ~/playbook.yml
ansible managed-node-01.example.com -m ansible.builtin.command -a 'firewall-cmd --zone=dmz --list-all' managed-node-01.example.com | CHANGED | rc=0 >> dmz (active) target: default icmp-block-inversion: no interfaces: enp1s0 sources: services: https ssh ports: protocols: forward: no masquerade: no forward-ports: source-ports: icmp-blocks:
table <table_address_family> <table_name> { }
nft add table <table_address_family> <table_name>
table <table_address_family> <table_name> { chain <chain_name> { type <type> hook <hook> priority <priority> policy <policy> ; } }
nft add chain <table_address_family> <table_name> <chain_name> { type <type> hook <hook> priority <priority> \; policy <policy> \; }
table <table_address_family> <table_name> { chain <chain_name> { type <type> hook <hook> priority <priority> ; policy <policy> ; <rule> } }
nft add rule <table_address_family> <table_name> <chain_name> <rule>
nft add table inet nftables_svc
nft add chain inet nftables_svc INPUT { type filter hook input priority filter \; policy accept \; }
nft add rule inet nftables_svc INPUT tcp dport 22 accept nft add rule inet nftables_svc INPUT tcp dport 443 accept nft add rule inet nftables_svc INPUT reject with icmpx type port-unreachable
nft -a list table inet nftables_svc table inet nftables_svc { # handle 13 chain INPUT { # handle 1 type filter hook input priority filter ; policy accept ; tcp dport 22 accept # handle 2 tcp dport 443 accept # handle 3 reject # handle 4 } }
nft insert rule inet nftables_svc INPUT position 3 tcp dport 636 accept
nft add rule inet nftables_svc INPUT position 3 tcp dport 80 accept
nft -a list table inet nftables_svc table inet nftables_svc { # handle 13 chain INPUT { # handle 1 type filter hook input priority filter ; policy accept ; tcp dport 22 accept # handle 2 tcp dport 636 accept # handle 5 tcp dport 443 accept # handle 3 tcp dport 80 accept # handle 6 reject # handle 4 } }
nft delete rule inet nftables_svc INPUT handle 6
nft -a list table inet nftables_svc table inet nftables_svc { # handle 13 chain INPUT { # handle 1 type filter hook input priority filter ; policy accept ; tcp dport 22 accept # handle 2 tcp dport 636 accept # handle 5 tcp dport 443 accept # handle 3 reject # handle 4 } }
nft flush chain inet nftables_svc INPUT
nft list table inet nftables_svc table inet nftables_svc { chain INPUT { type filter hook input priority filter; policy accept } }
nft delete chain inet nftables_svc INPUT
nft list table inet nftables_svc table inet nftables_svc { }
nft delete table inet nftables_svc
iptables-save >/root/iptables.dump ip6tables-save >/root/ip6tables.dump
iptables-restore-translate -f /root/iptables.dump > /etc/nftables/ruleset-migrated-from-iptables.nft ip6tables-restore-translate -f /root/ip6tables.dump > /etc/nftables/ruleset-migrated-from-ip6tables.nft
include "/etc/nftables/ruleset-migrated-from-iptables.nft" include "/etc/nftables/ruleset-migrated-from-ip6tables.nft"
systemctl disable --now iptables
systemctl enable --now nftables
nft list ruleset
iptables-translate -A INPUT -s 192.0.2.0/24 -j ACCEPT nft add rule ip filter INPUT ip saddr 192.0.2.0/24 counter accept
iptables-translate -A INPUT -j CHECKSUM --checksum-fill nft # -A INPUT -j CHECKSUM --checksum-fill
nft list table inet firewalld nft list table ip firewalld nft list table ip6 firewalld
#!/usr/sbin/nft -f Flush the rule set flush ruleset table inet example_table { chain example_chain { # Chain for incoming packets that drops all packets that # are not explicitly allowed by any rule in this chain type filter hook input priority 0; policy drop; # Accept connections to port 22 (ssh) tcp dport ssh accept } }
#!/usr/sbin/nft -f Flush the rule set flush ruleset Create a table add table inet example_table Create a chain for incoming packets that drops all packets that are not explicitly allowed by any rule in this chain add chain inet example_table example_chain { type filter hook input priority 0 ; policy drop ; } Add a rule that accepts connections to port 22 (ssh) add rule inet example_table example_chain tcp dport ssh accept
nft -f /etc/nftables/<example_firewall_script>.nft
#!/usr/sbin/nft -f
chown root /etc/nftables/<example_firewall_script>.nft
chmod u+x /etc/nftables/<example_firewall_script>.nft
/etc/nftables/<example_firewall_script>.nft
Flush the rule set flush ruleset add table inet example_table # Create a table
define INET_DEV = enp1s0
add rule inet example_table example_chain iifname USDINET_DEV tcp dport ssh accept
define DNS_SERVERS = { 192.0.2.1 , 192.0.2.2 }
add rule inet example_table example_chain ip daddr USDDNS_SERVERS accept
include "example.nft"
include "/etc/nftables/rulesets/*.nft"
include "/etc/nftables/_example_.nft"
systemctl start nftables
systemctl enable nftables
nft add table nat
nft add chain nat postrouting { type nat hook postrouting priority 100 \; }
nft add rule nat postrouting oifname " ens3 " masquerade
nft add table nat
nft add chain nat postrouting { type nat hook postrouting priority 100 \; }
nft add rule nat postrouting oifname " ens3 " snat to 192.0.2.1
nft add table nat
nft -- add chain nat prerouting { type nat hook prerouting priority -100 \; } nft add chain nat postrouting { type nat hook postrouting priority 100 \; }
nft add rule nat prerouting iifname ens3 tcp dport { 80, 443 } dnat to 192.0.2.1
nft add rule nat postrouting oifname "ens3" masquerade
nft add rule nat postrouting oifname "ens3" snat to 198.51.100.1
echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf
nft add table nat
nft -- add chain nat prerouting { type nat hook prerouting priority -100 \; }
nft add rule nat prerouting tcp dport 22 redirect to 2222
nft add table inet <example-table>
nft add flowtable inet <example-table> <example-flowtable> { hook ingress priority filter \; devices = { enp1s0, enp7s0 } \; }
nft add chain inet <example-table> <example-forwardchain> { type filter hook forward priority filter \; }
nft add rule inet <example-table> <example-forwardchain> ct state established flow add @ <example-flowtable>
nft list table inet <example-table> table inet example-table { flowtable example-flowtable { hook ingress priority filter devices = { enp1s0, enp7s0 } } chain example-forwardchain { type filter hook forward priority filter; policy accept; ct state established flow add @example-flowtable } }
nft add rule inet example_table example_chain tcp dport { 22, 80, 443 } accept
nft list table inet example_table table inet example_table { chain example_chain { type filter hook input priority filter; policy accept; tcp dport { ssh, http, https } accept } }
nft add set inet example_table example_set { type ipv4_addr \; }
nft add set inet example_table example_set { type ipv4_addr \; flags interval \; }
nft add rule inet example_table example_chain ip saddr @ example_set drop
nft add element inet example_table example_set { 192.0.2.1, 192.0.2.2 }
nft add element inet example_table example_set { 192.0.2.0-192.0.2.255 }
nft add table inet example_table
nft add chain inet example_table tcp_packets
nft add rule inet example_table tcp_packets counter
nft add chain inet example_table udp_packets
nft add rule inet example_table udp_packets counter
nft add chain inet example_table incoming_traffic { type filter hook input priority 0 \; }
nft add rule inet example_table incoming_traffic ip protocol vmap { tcp : jump tcp_packets, udp : jump udp_packets }
nft list table inet example_table table inet example_table { chain tcp_packets { counter packets 36379 bytes 2103816 } chain udp_packets { counter packets 10 bytes 1559 } chain incoming_traffic { type filter hook input priority filter; policy accept; ip protocol vmap { tcp : jump tcp_packets, udp : jump udp_packets } } }
nft add table ip example_table
nft add chain ip example_table example_chain { type filter hook input priority 0 \; }
nft add map ip example_table example_map { type ipv4_addr : verdict \; }
nft add rule example_table example_chain ip saddr vmap @ example_map
nft add element ip example_table example_map { 192.0.2.1 : accept, 192.0.2.2 : drop }
nft add element ip example_table example_map { 192.0.2.3 : accept }
nft delete element ip example_table example_map { 192.0.2.1 }
nft list ruleset table ip example_table { map example_map { type ipv4_addr : verdict elements = { 192.0.2.2 : drop, 192.0.2.3 : accept } } chain example_chain { type filter hook input priority filter; policy accept; ip saddr vmap @example_map } }
:msg, startswith, "nft drop" -/var/log/nftables.log & stop
systemctl restart rsyslog
/var/log/nftables.log { size +10M maxage 30 sharedscripts postrotate /usr/bin/systemctl kill -s HUP rsyslog.service >/dev/null 2>&1 || true endscript }
Remove all rules flush ruleset Table for both IPv4 and IPv6 rules table inet nftables_svc { # Define variables for the interface name define INET_DEV = enp1s0 define LAN_DEV = enp7s0 define DMZ_DEV = enp8s0 # Set with the IPv4 addresses of admin PCs set admin_pc_ipv4 { type ipv4_addr elements = { 10.0.0.100, 10.0.0.200 } } # Chain for incoming trafic. Default policy: drop chain INPUT { type filter hook input priority filter policy drop # Accept packets in established and related state, drop invalid packets ct state vmap { established:accept, related:accept, invalid:drop } # Accept incoming traffic on loopback interface iifname lo accept # Allow request from LAN and DMZ to local DNS server iifname { USDLAN_DEV, USDDMZ_DEV } meta l4proto { tcp, udp } th dport 53 accept # Allow admins PCs to access the router using SSH iifname USDLAN_DEV ip saddr @admin_pc_ipv4 tcp dport 22 accept # Last action: Log blocked packets # (packets that were not accepted in previous rules in this chain) log prefix "nft drop IN : " } # Chain for outgoing traffic. Default policy: drop chain OUTPUT { type filter hook output priority filter policy drop # Accept packets in established and related state, drop invalid packets ct state vmap { established:accept, related:accept, invalid:drop } # Accept outgoing traffic on loopback interface oifname lo accept # Allow local DNS server to recursively resolve queries oifname USDINET_DEV meta l4proto { tcp, udp } th dport 53 accept # Last action: Log blocked packets log prefix "nft drop OUT: " } # Chain for forwarding traffic. Default policy: drop chain FORWARD { type filter hook forward priority filter policy drop # Accept packets in established and related state, drop invalid packets ct state vmap { established:accept, related:accept, invalid:drop } # IPv4 access from LAN and internet to the HTTPS server in the DMZ iifname { USDLAN_DEV, USDINET_DEV } oifname USDDMZ_DEV ip daddr 198.51.100.5 tcp dport 443 accept # IPv6 access from internet to the HTTPS server in the DMZ iifname USDINET_DEV oifname USDDMZ_DEV ip6 daddr 2001:db8:b::5 tcp dport 443 accept # Access from LAN and DMZ to HTTPS servers on the internet iifname { USDLAN_DEV, USDDMZ_DEV } oifname USDINET_DEV tcp dport 443 accept # Last action: Log blocked packets log prefix "nft drop FWD: " } # Postrouting chain to handle SNAT chain postrouting { type nat hook postrouting priority srcnat; policy accept; # SNAT for IPv4 traffic from LAN to internet iifname USDLAN_DEV oifname USDINET_DEV snat ip to 203.0.113.1 } }
include "/etc/nftables/firewall.nft"
echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf
systemctl enable --now nftables
nft list ruleset
ssh router.example.com ssh: connect to host router.example.com port 22 : Network is unreachable
journalctl -k -g "nft drop" Oct 14 17:27:18 router kernel: nft drop IN : IN=enp8s0 OUT= MAC=... SRC=198.51.100.5 DST=198.51.100.1 ... PROTO=TCP SPT=40464 DPT=22 ... SYN
Oct 14 17:27:18 router kernel: nft drop IN : IN=enp8s0 OUT= MAC=... SRC=198.51.100.5 DST=198.51.100.1 ... PROTO=TCP SPT=40464 DPT=22 ... SYN
nft add table ip nat
nft -- add chain ip nat prerouting { type nat hook prerouting priority -100 \; }
nft add rule ip nat prerouting tcp dport 8022 redirect to :22
nft add table ip nat
nft -- add chain ip nat prerouting { type nat hook prerouting priority -100 \; } nft add chain ip nat postrouting { type nat hook postrouting priority 100 \; }
nft add rule ip nat prerouting tcp dport 443 dnat to 192.0.2.1
nft add rule ip nat postrouting daddr 192.0.2.1 masquerade
echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf
nft add table inet filter
nft add chain inet filter input { type filter hook input priority 0 \; }
nft add set inet filter limit-ssh { type ipv4_addr\; flags dynamic \;}
nft add rule inet filter input tcp dport ssh ct state new add @limit-ssh { ip saddr ct count over 2 } counter reject
nft list set inet filter limit-ssh table inet filter { set limit-ssh { type ipv4_addr size 65535 flags dynamic elements = { 192.0.2.1 ct count over 2 , 192.0.2.2 ct count over 2 } } }
nft add table ip filter
nft add chain ip filter input { type filter hook input priority 0 \; }
nft add set ip filter denylist { type ipv4_addr \; flags dynamic, timeout \; timeout 5m \; }
nft add rule ip filter input ip protocol tcp ct state new, untracked add @denylist { ip saddr limit rate over 10/minute } drop
nft add rule inet example_table example_chain tcp dport 22 counter accept
nft list ruleset table inet example_table { chain example_chain { type filter hook input priority filter; policy accept; tcp dport ssh counter packets 6872 bytes 105448565 accept } }
nft --handle list chain inet example_table example_chain table inet example_table { chain example_chain { # handle 1 type filter hook input priority filter; policy accept; tcp dport ssh accept # handle 4 } }
nft replace rule inet example_table example_chain handle 4 tcp dport 22 counter accept
nft list ruleset table inet example_table { chain example_chain { type filter hook input priority filter; policy accept; tcp dport ssh counter packets 6872 bytes 105448565 accept } }
nft --handle list chain inet example_table example_chain table inet example_table { chain example_chain { # handle 1 type filter hook input priority filter; policy accept; tcp dport ssh accept # handle 4 } }
nft replace rule inet example_table example_chain handle 4 tcp dport 22 meta nftrace set 1 accept
nft monitor | grep "inet example_table example_chain" trace id 3c5eb15e inet example_table example_chain packet: iif "enp1s0" ether saddr 52:54:00:17:ff:e4 ether daddr 52:54:00:72:2f:6e ip saddr 192.0.2.1 ip daddr 192.0.2.2 ip dscp cs0 ip ecn not-ect ip ttl 64 ip id 49710 ip protocol tcp ip length 60 tcp sport 56728 tcp dport ssh tcp flags == syn tcp window 64240 trace id 3c5eb15e inet example_table example_chain rule tcp dport ssh nftrace set 1 accept (verdict accept)
nft list ruleset > file .nft
nft -j list ruleset > file .json
nft -f file .nft
nft -j -f file .json
xdp-filter load enp1s0
xdp-filter port 22
xdp-filter ip 192.0.2.1 -m src
xdp-filter ether 00:53:00:AA:07:BE -m src
xdp-filter status
xdp-filter load enp1s0 -p deny
xdp-filter port 22
xdp-filter ip 192.0.2.1
xdp-filter ether 00:53:00:AA:07:BE
xdp-filter status