Main Page: Difference between revisions
Jump to navigation
Jump to search
(Updated link to matching packet headers.) |
(very confusing presentation, remove it) |
||
| (10 intermediate revisions by 4 users not shown) | |||
| Line 19: | Line 19: | ||
* [[nftables families|Understanding nftables families]] | * [[nftables families|Understanding nftables families]] | ||
* [[Data_types|Data types]] | * [[Data_types|Data types]] | ||
* [[Connection_Tracking_System|Connection tracking system (conntrack)]], used for stateful firewalling and NAT | |||
* [[Troubleshooting|Troubleshooting and FAQ]] | * [[Troubleshooting|Troubleshooting and FAQ]] | ||
* [[Further_documentation|Additional documentation]] | * [[Further_documentation|Additional documentation]] | ||
| Line 45: | Line 46: | ||
* [[Scripting]] | * [[Scripting]] | ||
* [[Ruleset debug/tracing]] | * [[Ruleset debug/tracing]] | ||
* [[Ruleset debug/VM code analysis]] | |||
* [[Output text modifiers]] | * [[Output text modifiers]] | ||
= Expressions: Matching packets = | = Expressions: Matching packets = | ||
* [[Matching packet metainformation]] | |||
* [[Matching packet headers]] | * [[Matching packet headers]] | ||
* [[Matching connection tracking stateful metainformation]] | * [[Matching connection tracking stateful metainformation]] | ||
* [[Matching routing information]] | |||
* [[Rate limiting matchings]] | * [[Rate limiting matchings]] | ||
= Statements: Acting on packet matches = | = Statements: Acting on packet matches = | ||
* [[Accepting and dropping packets]] | * [[Accepting and dropping packets]] | ||
* [[Rejecting traffic]] | |||
* [[Jumping to chain]] | * [[Jumping to chain]] | ||
* [[ | * [[Counters]] | ||
* [[Logging traffic]] | * [[Logging traffic]] | ||
* [[Performing Network Address Translation (NAT)]] | * [[Performing Network Address Translation (NAT)]] | ||
* [[Setting packet metainformation]] | * [[Setting packet metainformation]] | ||
* [[ | * [[Setting packet connection tracking metainformation]] | ||
* [[Mangling packet headers]] (including stateless NAT) | |||
* [[Duplicating packets]] | * [[Duplicating packets]] | ||
* [[Load balancing]] | * [[Load balancing]] | ||
* [[ | * [[Queueing to userspace]] | ||
| Line 94: | Line 94: | ||
** [[Verdict_Maps_(vmaps) | Verdict maps]] | ** [[Verdict_Maps_(vmaps) | Verdict maps]] | ||
** [[Meters|Metering]] (formerly known as flow tables before nftables 0.8.1) | ** [[Meters|Metering]] (formerly known as flow tables before nftables 0.8.1) | ||
* [[ | * [[Flowtables]] (the fastpath network stack bypass) | ||
| Line 100: | Line 100: | ||
* [[Simple ruleset for a workstation]] | * [[Simple ruleset for a workstation]] | ||
* [[Simple ruleset for a server]] | * [[Simple ruleset for a server]] | ||
* [[Simple ruleset for a home router]] | |||
* [[Bridge filtering]] | * [[Bridge filtering]] | ||
* [[Multiple NATs using nftables maps]] | * [[Multiple NATs using nftables maps]] | ||
| Line 107: | Line 108: | ||
* [[Using configuration management systems]] (like puppet, ansible, etc) | * [[Using configuration management systems]] (like puppet, ansible, etc) | ||
* [[GeoIP matching]] | * [[GeoIP matching]] | ||
= Development = | = Development = | ||
| Line 129: | Line 129: | ||
* [https://www.youtube.com/watch?v=Sy0JDX451ns Florian Westphal - Why nftables?] | * [https://www.youtube.com/watch?v=Sy0JDX451ns Florian Westphal - Why nftables?] | ||
* Watch [https://www.youtube.com/watch?v=0wQfSfDVN94 NLUUG - Goodbye iptables, Hello nftables] | * Watch [https://www.youtube.com/watch?v=0wQfSfDVN94 NLUUG - Goodbye iptables, Hello nftables] | ||
Watch videos to track updates: | Watch videos to track updates: | ||
Latest revision as of 14:47, 12 October 2024
Welcome to the nftables HOWTO documentation page. Here you will find documentation on how to build, install, configure and use nftables.
If you have any suggestion to improve it, please send your comments to Netfilter users mailing list <netfilter@vger.kernel.org>.
News
Introduction
Reference
- man nft - netfilter website
- man nft - mankier.com
- Quick reference, nftables in 10 minutes
- Netfilter hooks and nftables integration with existing Netfilter components
- Understanding nftables families
- Data types
- Connection tracking system (conntrack), used for stateful firewalling and NAT
- Troubleshooting and FAQ
- Additional documentation
Installing nftables
Upgrading from xtables to nftables
Basic operation
- Configuring tables
- Configuring chains
- Simple rule management
- Atomic rule replacement
- Error reporting from the command line
- Building rules through expressions
- Operations at ruleset level
- Monitoring ruleset updates
- Scripting
- Ruleset debug/tracing
- Ruleset debug/VM code analysis
- Output text modifiers
Expressions: Matching packets
- Matching packet metainformation
- Matching packet headers
- Matching connection tracking stateful metainformation
- Matching routing information
- Rate limiting matchings
Statements: Acting on packet matches
- Accepting and dropping packets
- Rejecting traffic
- Jumping to chain
- Counters
- Logging traffic
- Performing Network Address Translation (NAT)
- Setting packet metainformation
- Setting packet connection tracking metainformation
- Mangling packet headers (including stateless NAT)
- Duplicating packets
- Load balancing
- Queueing to userspace
Advanced data structures for performance packet classification
- Intervals
- Concatenations
- Math operations
- Stateful objects
- Counters
- Quotas
- Limits
- Connlimits (ct count)
- Other objects
- Conntrack helpers (ct helper, Layer 7 ALG)
- Conntrack timeout policies (ct timeout)
- Conntrack expectations (ct expectation)
- Synproxy
- Secmarks
- Generic set infrastructure
- Sets
- Element timeouts
- Updating sets from the packet path
- Maps
- Verdict maps
- Metering (formerly known as flow tables before nftables 0.8.1)
- Flowtables (the fastpath network stack bypass)
Examples
- Simple ruleset for a workstation
- Simple ruleset for a server
- Simple ruleset for a home router
- Bridge filtering
- Multiple NATs using nftables maps
- Classic perimetral firewall example
- Port knocking example
- Classification to tc structure example
- Using configuration management systems (like puppet, ansible, etc)
- GeoIP matching
Development
Check Portal:DeveloperDocs - documentation for netfilter developers.
Some hints on the general development progress:
- List of updates since Linux kernel 3.13
- List of updates in the nft command line tool
- Supported features compared to {ip,ip6,eb,arp}tables
- List of available translations via iptables-translate tool
External links
Watch some videos:
- Watch Getting a grasp of nftables, thanks to NLUUG association for recording this.
- Watch The ultimate packet classifier for GNU/Linux, thanks to the FSFE for paying my trip to Barcelona and for recommending me as speaker to the KDE Spanish branch.
- Florian Westphal - Why nftables?
- Watch NLUUG - Goodbye iptables, Hello nftables
Watch videos to track updates:
- Watch Netdev 2.1 - Netfilter mini-workshop (2017)
- Watch Netdev 2.2 - Netfilter mini-workshop (2018)
- Watch Netdev 0x12 - Netfilter mini-workshop (2019)
- Watch Netdev 0x14 - Netfilter mini-Workshop (2020)
Additional documentations and articles:
- Tutorial Extending nftables by Xiang Gao
- Article New in Debian stable Stretch: nftables
- Article How to use nftables from python and git repository python-nftables-tutorial.git
Thanks
To the NLnet foundation for initial sponsorship of this HOWTO:
To Eric Leblond, for boostrapping the Nftables quick howto in 2013.