nftables 学习笔记

19 Sep 2014

Introduction

WHAT

  1. kernel 3.13
  2. nft, syntax different to iptables
  3. compatibility layer for iptables
  4. set infrastructure for mappings between matchings and actions
  5. consider WIP

difference with iptables

  1. syntax
    • iptables - getopt_long()-based
    • nftables - tcpdump-inspired
  2. configurable tables and chains
  3. matches and targets no distinction
  4. multiple actions in one rule
  5. no built-in counter
  6. generic set infrastructure
  7. new protocols without kernel upgrades – pseudo-state machine

netfilter hooks

                                              Local machine
                                               ^         |                 .-----------.
                    .-----------.              |         |                 |  Routing  |
                    |           |-----> Input /           \---> Output --->|  Decision |------
---> Prerouting --->|  Routing  |                                          |-----------|      \
                    | Decision  |                                                              ---> Postrouting --->
                    |           |                                                             /
                    |           |---------------> Forward ------------------------------------
                    |-----------|

Basic

tables

  1. no predefined table
  2. kind of tables depending on the family
    • ip
    • arp
    • ip6
    • bridge
    • inet (Linux 3.14) – IPv4 + IPv6
  3. adding
    • nft add table FAMILY NAME – nft add table ip filter
  4. listing
    • nft list tables FAMILY – nft list tables ip
    • nft list table FAMILY NAME – nft list table ip filter
  5. deleting
    • nft delete table FAMILY NAME – nft delete table ip filter (only works if the table does not contain any chain)
  6. flushing
    • nft flush table FAMILY NAME – nft flush table ip filter

chains

  1. base chains – registered into the netfilter hooks
  2. adding
    • nft add chain ip filter input { type filter hook input priority 0 \; }
    • registers the input chain, attached to the input hook
    • priority
    • nft add chain ip filter output { type filter hook output priority 0 \; }
  3. types
    • filter - filter packets, arp, bridge, ip, ip6, inet
    • route - reroute if relevant IP head field or the packet mark is modified, ip, ip6
    • nat - only the first packet of a flow hits this chain, not for filtering, ip, ip6
  4. hooks
    • prerouting
    • input
    • forward
    • output
    • postrouting
  5. priority - used to order the chains or to put them before or after some netfilter internal operations
    • NF_IP_PRI_CONNTRACK_DEFRAG (-400): priority of defragmentation
    • NF_IP_PRI_RAW (-300): traditional priority of the raw table placed before connection tracking operation
    • NF_IP_PRI_SELINUX_FIRST (-225): SELinux operations
    • NF_IP_PRI_CONNTRACK (-200): Connection tracking operations
    • NF_IP_PRI_MANGLE (-150): mangle operation
    • NF_IP_PRI_NAT_DST (-100): destination NAT
    • NF_IP_PRI_FILTER (0): filtering operation, the filter table
    • NF_IP_PRI_SECURITY (50): Place of security table where secmark can be set for example
    • NF_IP_PRI_NAT_SRC (100): source NAT
    • NF_IP_PRI_SELINUX_LAST (225): SELInux at packet exit
    • NF_IP_PRI_CONNTRACK_HELPER (300): connection tracking at exit
  6. non-base chains
    • nft add chain ip filter NAME
  7. deleting
    • nft delete chain ip filter input
  8. flushing
    • nft flush chain ip filter input
  9. example
    • nft add table ip filter
    • nft add chain ip filter input { type filter hook input priority 0 \; }
    • nft add chain ip filter output { type filter hook output priority 0 \; }

rules

  1. adding

     nft add rule   filter      output     ip daddr 8.8.8.8    counter
               ^-table-^   ^-chain-^   ^^--matching--^^   ^-action-^
  2. listing
    • nft list table filter
    • nft add rule filter output tcp dport ssh counter
    • disable host name resolution by -n
    • disable service name resolution by -nn
  3. testing?
  4. rule position
    • rule handle: -a
    • nft add rule filter output position 8 ip daddr 127.0.0.8 drop # adding after rule with handle 8
    • nft insert rule filter output position 8 ip daddr 127.0.0.8 drop # adding before rule with handle 8
  5. deleting
    • nft delete rule filter output handle 8 # delete rule with handle 8
    • NOT IMPLEMENTED YET: nft delete rule filter output ip saddr 192.168.1.1 counter # delete such a rule
  6. delete all rules
    • in a chain: nft delete rule filter output
    • in a table: nft flush table filter
  7. prepending
    • nft insert rule filter output ip daddr 127.0.0.1 counter
  8. atomic rule replacement
    • nft -f file
    • nft list table filter > filter-table
    • nft -f filter-table
    • ATOMIC in one single transaction(kernel), shell scripts CANNOT achieve this

building rules through expressions

exporting/importing rules

Matching

packet header

packet metainformation

conntrack metainformation

rate limiting matchings

actions

accepting and dropping

jumping

rejecting

logging

nat

setting packet metainformation

queueing

counter

advanced data structures

sets

dictionaries

intervals

maps