Matching routing information - Revision history

Fmyhr: Fmyhr moved page Routing information to Matching routing information: Parallelize title with the other "matching" pages. Will update links immediately.

2021-04-16T22:19:48Z

Fmyhr moved page Routing information to Matching routing information: Parallelize title with the other "matching" pages. Will update links immediately.

← Older revision		Revision as of 22:19, 16 April 2021
(No difference)

Pablo: /* nexthop */ Use meter

2020-12-18T17:57:41Z

nexthop: Use meter

← Older revision		Revision as of 17:57, 18 December 2020
Line 13:		Line 13:

	<source>		<source>
	nft add rule filter postrouting ~~flow table~~ acct { rt nexthop timeout 600s counter }		nft add rule filter postrouting meter acct { rt nexthop timeout 600s counter }
	nft add rule ip6 filter postrouting ~~flow table~~ acct { rt nexthop timeout 600s counter }		nft add rule ip6 filter postrouting meter acct { rt nexthop timeout 600s counter }
	</source>		</source>

Fw: /* fib */

2019-11-15T16:00:25Z

fib

← Older revision		Revision as of 16:00, 15 November 2019
Line 55:		Line 55:
	</source>		</source>

	Its also possible to use ~~mark and~~ verdict ~~map~~, eg:		Its also possible to use verdict maps, eg:

	<source>		<source>
	nft add rule x prerouting ~~meta mark set 0xdead~~ fib ~~daddr~~ . mark ~~type~~ vmap {		nft 'add rule x prerouting fib saddr . mark oif vmap { "eth0" : drop, "ppp0" : accept }'
	~~blackhole : drop,~~
	~~prohibit~~ : drop,
	~~unicast~~ : accept
	}
	</source>		</source>

			This takes the packet source address and queries the routing table
			for the output interface index that would be used to send a packet
			to that address. The packets destination address is used as source
			address. The ". mark" syntax tells the fib expression it should also
			consider the packet mark when the fib is queried.
			Likewise, "iif" and "oif" tell fib to consider the packets in and output
			interface on lookup.

	General syntax is: '''fib''' ''key'' ''data'' operator ''expression'', where:		General syntax is: '''fib''' ''key'' ''data'' operator ''expression'', where:

Arturo: /* nexthop */ add hints about general syntax

2017-05-04T10:16:15Z

nexthop: add hints about general syntax

← Older revision		Revision as of 10:16, 4 May 2017
Line 19:		Line 19:
	These rules count outgoing traffic per nexthop. Note that the timeout releases an entry if no traffic		These rules count outgoing traffic per nexthop. Note that the timeout releases an entry if no traffic
	is seen for this nexthop within 10 minutes.		is seen for this nexthop within 10 minutes.

			General syntax is: '''rt''' ''key'' operator ''expression'', where:

			* key: classid, nexthop
			* operator: eq, neq, gt, lt, gte, lte, vmap, map

	== fib ==		== fib ==

Arturo: /* fib */ add hints about syntax

2017-05-04T10:14:55Z

fib: add hints about syntax

← Older revision		Revision as of 10:14, 4 May 2017
Line 59:		Line 59:
	}		}
	</source>		</source>

			General syntax is: '''fib''' ''key'' ''data'' operator ''expression'', where:

			* key: saddr, daddr, mark, iif, oif (use '.' for concatenations to represent tuples)
			* data: oif, oifname, (address) type
			* operator: eq, neq, vmap, map

Arturo: create page with basic examples

2016-12-23T13:31:05Z

create page with basic examples

New page

Starting with linux 4.10 and nftables v0.7, there are new mechanisms to match several routing information related to packets and the firewall machine.

== nexthop ==

The directly connected IP address that an outgoing packet is sent to, which can be used either
for matching or accounting, eg:

<source>
nft add rule filter postrouting ip daddr 192.168.1.0/24 rt nexthop != 192.168.0.1 drop
</source>

This will drop any traffic to 192.168.1.0/24 that is not routed via 192.168.0.1.

<source>
nft add rule filter postrouting flow table acct { rt nexthop timeout 600s counter }
nft add rule ip6 filter postrouting flow table acct { rt nexthop timeout 600s counter }
</source>

These rules count outgoing traffic per nexthop. Note that the timeout releases an entry if no traffic
is seen for this nexthop within 10 minutes.

== fib ==

The fib statement can be used to obtain the output interface from the route table based on either source
or destination address of a packet.

This can be used to e.g. add reverse path filtering, or eg. drop if not coming from the same interface packet arrived on:

<source>
nft add rule x prerouting fib saddr . iif oif eq 0 drop
</source>

Accept only if from eth:

<source>
nft add rule x prerouting fib saddr . iif oif eq "eth0" accept
</source>

Accept if from any valid interface:

<source>
nft add rule x prerouting fib saddr oif accept
</source>

Querying of address type is also supported, this can be used to only accept packets to addresses configured in the same
interface, eg:

<source>
nft add rule x prerouting fib daddr . iif type local accept
</source>

Its also possible to use mark and verdict map, eg:

<source>
nft add rule x prerouting meta mark set 0xdead fib daddr . mark type vmap {
blackhole : drop,
prohibit : drop,
unicast : accept
}
</source>