nftables - Revision history

Vincent: https links

2018-12-22T06:56:45Z

https links

← Older revision		Revision as of 06:56, 22 December 2018
Line 3:		Line 3:
	* Rules that target both IPV4 and IPV6		* Rules that target both IPV4 and IPV6
	* More concise syntax		* More concise syntax
	* [~~http~~://wiki.nftables.org/wiki-nftables/index.php/Main_differences_with_iptables See details on the official wiki]		*[https://wiki.nftables.org/wiki-nftables/index.php/Main_differences_with_iptables See details on the official wiki]

	== Install ==		== Install ==
Line 57:		Line 57:
	53, # DNS		53, # DNS
	5060, # SIP		5060, # SIP
	53413 # ~~http~~://blog.trendmicro.com/trendlabs-security-intelligence/netis-routers-leave-wide-open-backdoor/		53413 # https://blog.trendmicro.com/trendlabs-security-intelligence/netis-routers-leave-wide-open-backdoor/
	}		}

Vincent at 21:39, 12 November 2017

2017-11-12T21:39:21Z

← Older revision		Revision as of 21:39, 12 November 2017
Line 4:		Line 4:
	* More concise syntax		* More concise syntax
	* [http://wiki.nftables.org/wiki-nftables/index.php/Main_differences_with_iptables See details on the official wiki]		* [http://wiki.nftables.org/wiki-nftables/index.php/Main_differences_with_iptables See details on the official wiki]

	~~== Prerequisite ==~~

	~~If you are running Debian Jessie, it is recommended to install the [[Kernel from Jessie Backports\|kernel from Jessie Backports]].~~

	== Install ==		== Install ==

Vincent: sudo

2017-02-26T19:21:37Z

sudo

← Older revision		Revision as of 19:21, 26 February 2017
Line 11:		Line 11:
	== Install ==		== Install ==
	<syntaxhighlight lang="console">		<syntaxhighlight lang="console">
	# apt install nftables		$ sudo apt install nftables
	</syntaxhighlight>You might also want to remove <code>iptables</code><syntaxhighlight lang="console">		</syntaxhighlight>You might also want to remove <code>iptables</code><syntaxhighlight lang="console">
	# apt purge iptables		$ sudo apt purge iptables
	</syntaxhighlight>		</syntaxhighlight>

Line 135:		Line 135:
	include "/etc/nftables/main.conf"		include "/etc/nftables/main.conf"
	</syntaxhighlight>and make it executable<syntaxhighlight lang="console">		</syntaxhighlight>and make it executable<syntaxhighlight lang="console">
	# chmod +x /etc/nftables/reload_main.conf		$ sudo chmod +x /etc/nftables/reload_main.conf
	</syntaxhighlight>		</syntaxhighlight>

	== Test ==		== Test ==
	Test your firewall with the following command<syntaxhighlight lang="console">		Test your firewall with the following command<syntaxhighlight lang="console">
	# /etc/nftables.conf; sleep 30; nft flush ruleset		$ sudo -- sh -c 'nft -f /etc/nftables.conf; sleep 30; nft flush ruleset'
	</syntaxhighlight>It will activate the firewall and reset it after 30 seconds. It allows you to not lock yourself out of your machine.		</syntaxhighlight>It will activate the firewall and reset it after 30 seconds. It allows you to not lock yourself out of your machine.

	== Enable ==		== Enable ==
	{{Warning}}It is recommended that you test your firewall before enabling it at boot time. An incorrectly configured firewall can lock you out of your machine.<syntaxhighlight lang="console">		{{Warning}}It is recommended that you test your firewall before enabling it at boot time. An incorrectly configured firewall can lock you out of your machine.<syntaxhighlight lang="console">
	# systemctl enable nftables		$ sudo systemctl enable nftables
	</syntaxhighlight>It the script output <code>update-rc.d: error: nftables Default-Start contains no runlevels, aborting.</code>, don’t worry. The firewall is correctly enabled in systemd. This is bug [https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=804648 #804648].		</syntaxhighlight>
	[[Category:Debian Release]]		[[Category:Debian Release]]
	[[Category:Linux Desktop]]		[[Category:Linux Desktop]]
	[[Category:Linux Server]]		[[Category:Linux Server]]
	[[Category:nftables]]		[[Category:nftables]]

Vincent: nftables category

2016-05-30T15:12:19Z

nftables category

← Older revision		Revision as of 15:12, 30 May 2016
Line 150:		Line 150:
	[[Category:Linux Desktop]]		[[Category:Linux Desktop]]
	[[Category:Linux Server]]		[[Category:Linux Server]]
			[[Category:nftables]]

Vincent: Split main.conf between static and variable part

2016-05-14T15:37:09Z

Split main.conf between static and variable part

← Older revision		Revision as of 15:37, 14 May 2016
Line 19:		Line 19:

	=== Create main table ===		=== Create main table ===
	Create file <code>/etc/nftables/~~main~~.conf</code><syntaxhighlight lang="sh">		Create file <code>/etc/nftables/main_config.conf</code><syntaxhighlight lang="sh">
	~~#!/usr/sbin/nft -f~~

	~~add table inet main~~

	~~#Ports open for any IP address~~
	~~add set inet main tcp_port_out { type inet_service; }~~
	~~add set inet main tcp_port_in { type inet_service; }~~
	~~add set inet main udp_port_out { type inet_service; }~~
	~~add set inet main udp_port_in { type inet_service; }~~

	# DNS		# DNS
	add element inet main udp_port_out { 53 }		add element inet main udp_port_out { 53 }
Line 42:		Line 32:
	# Web		# Web
	add element inet main tcp_port_out { 80, 443 }		add element inet main tcp_port_out { 80, 443 }
			</syntaxhighlight>Create file <code>/etc/nftables/main.conf</code><syntaxhighlight lang="sh">
			#!/usr/sbin/nft -f

			add table inet main

			#Ports open for any IP address
			add set inet main tcp_port_out { type inet_service; }
			add set inet main tcp_port_in { type inet_service; }
			add set inet main udp_port_out { type inet_service; }
			add set inet main udp_port_in { type inet_service; }
			add set inet main user_out { type uid; }
			add set inet main user_in { type uid; }

			include "/etc/nftables/main_config.conf"

	# Remove spam in logs. Get your top noise whith		# Remove spam in logs. Get your top noise whith
Line 50:		Line 54:
	22, # SSH		22, # SSH
	23, # Telnet		23, # Telnet
	1433 # MS SQL Login		1433, # MS SQL Login
			8080, # HTTP Alternate
			50661 # Apple Xsan
	}		}
	add element inet main udp_scan_ports {		add element inet main udp_scan_ports {
Line 76:		Line 82:
	tcp dport @tcp_port_in ct state new accept		tcp dport @tcp_port_in ct state new accept
	udp dport @udp_port_in ct state new accept		udp dport @udp_port_in ct state new accept
			meta skuid @user_in ct state new accept

	tcp dport @tcp_scan_ports drop		tcp dport @tcp_scan_ports drop
Line 101:		Line 108:
	tcp dport @tcp_port_out ct state new accept		tcp dport @tcp_port_out ct state new accept
	udp dport @udp_port_out ct state new accept		udp dport @udp_port_out ct state new accept
			meta skuid @user_out ct state new accept

	counter log prefix "Drop_out " drop		counter log prefix "Drop_out " drop

Vincent: Add dropped port for MS SQL

2016-04-27T06:17:29Z

Add dropped port for MS SQL

← Older revision		Revision as of 06:17, 27 April 2016
Line 49:		Line 49:
	add element inet main tcp_scan_ports {		add element inet main tcp_scan_ports {
	22, # SSH		22, # SSH
	23 # Telnet		23, # Telnet
			1433 # MS SQL Login
	}		}
	add element inet main udp_scan_ports {		add element inet main udp_scan_ports {

Vincent: Adapt for desktop usage

2016-03-30T09:37:27Z

Adapt for desktop usage

← Older revision		Revision as of 09:37, 30 March 2016
Line 7:		Line 7:
	== Prerequisite ==		== Prerequisite ==

	It is recommended to install the [[Kernel from Jessie Backports\|kernel from Jessie Backports]].		If you are running Debian Jessie, it is recommended to install the [[Kernel from Jessie Backports\|kernel from Jessie Backports]].

	== Install ==		== Install ==
Line 139:		Line 139:
	</syntaxhighlight>It the script output <code>update-rc.d: error: nftables Default-Start contains no runlevels, aborting.</code>, don’t worry. The firewall is correctly enabled in systemd. This is bug [https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=804648 #804648].		</syntaxhighlight>It the script output <code>update-rc.d: error: nftables Default-Start contains no runlevels, aborting.</code>, don’t worry. The firewall is correctly enabled in systemd. This is bug [https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=804648 #804648].
	[[Category:Debian Release]]		[[Category:Debian Release]]
			[[Category:Linux Desktop]]
	[[Category:Linux Server]]		[[Category:Linux Server]]

Vincent: remove iptables

2016-03-30T09:27:39Z

remove iptables

← Older revision		Revision as of 09:27, 30 March 2016
Line 12:		Line 12:
	<syntaxhighlight lang="console">		<syntaxhighlight lang="console">
	# apt install nftables		# apt install nftables
			</syntaxhighlight>You might also want to remove <code>iptables</code><syntaxhighlight lang="console">
			# apt purge iptables
	</syntaxhighlight>		</syntaxhighlight>

Vincent: Test

2016-03-28T07:31:10Z

Test

← Older revision		Revision as of 07:31, 28 March 2016
Line 126:		Line 126:
	# chmod +x /etc/nftables/reload_main.conf		# chmod +x /etc/nftables/reload_main.conf
	</syntaxhighlight>		</syntaxhighlight>

			== Test ==
			Test your firewall with the following command<syntaxhighlight lang="console">
			# /etc/nftables.conf; sleep 30; nft flush ruleset
			</syntaxhighlight>It will activate the firewall and reset it after 30 seconds. It allows you to not lock yourself out of your machine.

	== Enable ==		== Enable ==

Vincent: mediawiki is not using markdown. mediawiki is not using markdown. mediawiki is not using markdown. mediawiki is not using markdown. mediawiki is not using markdown.

2016-03-28T07:26:20Z

mediawiki is not using markdown. mediawiki is not using markdown. mediawiki is not using markdown. mediawiki is not using markdown. mediawiki is not using markdown.

← Older revision		Revision as of 07:26, 28 March 2016
Line 130:		Line 130:
	{{Warning}}It is recommended that you test your firewall before enabling it at boot time. An incorrectly configured firewall can lock you out of your machine.<syntaxhighlight lang="console">		{{Warning}}It is recommended that you test your firewall before enabling it at boot time. An incorrectly configured firewall can lock you out of your machine.<syntaxhighlight lang="console">
	# systemctl enable nftables		# systemctl enable nftables
	</syntaxhighlight>It the script output `update-rc.d: error: nftables Default-Start contains no runlevels, aborting.`, don’t worry. The firewall is correctly enabled in systemd. This is bug [https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=804648 #804648].		</syntaxhighlight>It the script output <code>update-rc.d: error: nftables Default-Start contains no runlevels, aborting.</code>, don’t worry. The firewall is correctly enabled in systemd. This is bug [https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=804648 #804648].
	[[Category:Debian Release]]		[[Category:Debian Release]]
	[[Category:Linux Server]]		[[Category:Linux Server]]