Difference between revisions of "nftables"

From wiki
(Enable)
(Add configuration)
Line 1: Line 1:
[https://netfilter.org/projects/nftables/ nftables] is the new firewall of the linux kernel.
+
[https://netfilter.org/projects/nftables/ nftables] is the new firewall of the linux kernel. It has several advantages over the existing {ip, ip6, arp,eb}tables:
 +
* Only one command
 +
* Rules that target both IPV4 and IPV6
 +
* More concise syntax
 +
* [http://wiki.nftables.org/wiki-nftables/index.php/Main_differences_with_iptables See details on the official wiki]
  
 
== Prerequisite ==
 
== Prerequisite ==
Line 8: Line 12:
 
<syntaxhighlight lang="console">
 
<syntaxhighlight lang="console">
 
# apt install nftables
 
# apt install nftables
 +
</syntaxhighlight>
 +
 +
== Configure ==
 +
 +
=== Create main table ===
 +
Create file <code>/etc/nftables/main.conf</code><syntaxhighlight lang="sh">
 +
#!/usr/sbin/nft -f
 +
 +
add table inet main
 +
 +
#Ports open for any IP address
 +
add set  inet main  tcp_port_out { type inet_service; }
 +
add set  inet main  tcp_port_in { type inet_service; }
 +
add set  inet main  udp_port_out { type inet_service; }
 +
add set  inet main  udp_port_in { type inet_service; }
 +
 +
# DNS
 +
add element  inet main  udp_port_out { 53 }
 +
add element  inet main  tcp_port_out { 53 }
 +
# Network Time Protocol
 +
add element  inet main  udp_port_out { 123 }
 +
# OpenPGP HTTP Keyserver
 +
add element  inet main  tcp_port_out { 11371 }
 +
# SSH
 +
add element  inet main  tcp_port_in { 2200 }
 +
add element  inet main  tcp_port_out { 2200 }
 +
# Web
 +
add element  inet main  tcp_port_out { 80, 443 }
 +
 +
# Remove spam in logs. Get your top noise whith
 +
# grep Drop_in /var/log/syslog|sed -r 's/.*?PROTO=([A-Z]+).*?DPT=([0-9]+).*/\1 \2/'|sort|uniq -c|sort -rn
 +
add set  inet main  tcp_scan_ports { type inet_service; }
 +
add set  inet main  udp_scan_ports { type inet_service; }
 +
add element  inet main  tcp_scan_ports {
 +
22, # SSH
 +
23 # Telnet
 +
}
 +
add element  inet main  udp_scan_ports {
 +
53, # DNS
 +
5060, # SIP
 +
53413 # http://blog.trendmicro.com/trendlabs-security-intelligence/netis-routers-leave-wide-open-backdoor/
 +
}
 +
 +
chain inet main input {
 +
        type filter  hook input  priority 0;
 +
 +
        # accept any localhost traffic
 +
        iif lo  accept
 +
 +
        # accept traffic originated from us
 +
        ct state established,related  accept
 +
        ct state invalid  log prefix "Invalid_in "  drop
 +
 +
        # accept neighbour discovery otherwise IPv6 connectivity breaks.
 +
        ip6 nexthdr icmpv6  icmpv6 type { nd-neighbor-solicit,  nd-router-advert, nd-neighbor-advert }  accept
 +
 +
        # accept ping
 +
        ip protocol icmp  icmp type { echo-request }  accept
 +
 +
        tcp  dport @tcp_port_in  ct state new  accept
 +
        udp  dport @udp_port_in  ct state new  accept
 +
 +
        tcp dport @tcp_scan_ports drop
 +
        udp dport @udp_scan_ports drop
 +
 +
        # count and drop any other traffic
 +
        counter  log prefix "Drop_in "  drop
 +
}
 +
 +
chain inet main output {
 +
        type filter  hook output  priority 0;
 +
 +
        # accept any localhost traffic
 +
        oif lo  accept
 +
 +
        ct state established,related  accept
 +
        ct state invalid  log prefix "Invalid_out "  drop
 +
 +
        # accept neighbour discovery otherwise IPv6 connectivity breaks.
 +
        ip6 nexthdr icmpv6  icmpv6 type { nd-neighbor-solicit,  nd-router-advert, nd-neighbor-advert }  accept
 +
 +
        # accept ping
 +
        ip protocol icmp  icmp type { echo-request }  accept
 +
 +
        tcp  dport @tcp_port_out  ct state new accept
 +
        udp  dport @udp_port_out  ct state new accept
 +
 +
        counter  log prefix "Drop_out "  drop
 +
}
 +
</syntaxhighlight>{{Warning}}Double check the port for SSH before activating the script.
 +
 +
=== Activation Scripts ===
 +
 +
==== /etc/nftables.conf ====
 +
Edit file <code>/etc/nftables.conf</code><syntaxhighlight lang="sh">
 +
#!/usr/sbin/nft -f
 +
 +
flush ruleset
 +
 +
include "/etc/nftables/main.conf"
 +
</syntaxhighlight>This file is executed when you start nftables. You can also manually execute it without issue.
 +
 +
==== /etc/nftables/reload_main.conf ====
 +
This script is used to reload only the main table without the others. The point is to integrate with tools like [[Fail2Ban]] which are inserting rules in the firewall. By reloading just the main table, you can activate your new rules without impacting Fail2Ban.
 +
 +
Create file <code>/etc/nftables/reload_main.conf</code><syntaxhighlight lang="sh">
 +
#!/usr/sbin/nft -f
 +
 +
delete table inet main
 +
 +
include "/etc/nftables/main.conf"
 +
</syntaxhighlight>and make it executable<syntaxhighlight lang="console">
 +
# chmod +x /etc/nftables/reload_main.conf
 
</syntaxhighlight>
 
</syntaxhighlight>
  

Revision as of 07:24, 28 March 2016

nftables is the new firewall of the linux kernel. It has several advantages over the existing {ip, ip6, arp,eb}tables:

Prerequisite

It is recommended to install the kernel from Jessie Backports.

Install

# apt install nftables

Configure

Create main table

Create file /etc/nftables/main.conf

#!/usr/sbin/nft -f

add table inet main

#Ports open for any IP address
add set  inet main  tcp_port_out { type inet_service; }
add set  inet main  tcp_port_in { type inet_service; }
add set  inet main  udp_port_out { type inet_service; }
add set  inet main  udp_port_in { type inet_service; }

# DNS
add element  inet main  udp_port_out { 53 }
add element  inet main  tcp_port_out { 53 }
# Network Time Protocol
add element  inet main  udp_port_out { 123 }
# OpenPGP HTTP Keyserver
add element  inet main  tcp_port_out { 11371 }
# SSH
add element  inet main  tcp_port_in { 2200 }
add element  inet main  tcp_port_out { 2200 }
# Web
add element  inet main  tcp_port_out { 80, 443 }

# Remove spam in logs. Get your top noise whith
# grep Drop_in /var/log/syslog|sed -r 's/.*?PROTO=([A-Z]+).*?DPT=([0-9]+).*/\1 \2/'|sort|uniq -c|sort -rn
add set  inet main  tcp_scan_ports { type inet_service; }
add set  inet main  udp_scan_ports { type inet_service; }
add element  inet main  tcp_scan_ports {
22, # SSH
23 # Telnet
}
add element  inet main  udp_scan_ports {
53, # DNS
5060, # SIP
53413 # http://blog.trendmicro.com/trendlabs-security-intelligence/netis-routers-leave-wide-open-backdoor/
}

chain inet main input {
        type filter  hook input  priority 0;

        # accept any localhost traffic
        iif lo  accept

        # accept traffic originated from us
        ct state established,related  accept
        ct state invalid  log prefix "Invalid_in "  drop

        # accept neighbour discovery otherwise IPv6 connectivity breaks.
        ip6 nexthdr icmpv6  icmpv6 type { nd-neighbor-solicit,  nd-router-advert, nd-neighbor-advert }  accept

        # accept ping
        ip protocol icmp  icmp type { echo-request }  accept

        tcp  dport @tcp_port_in  ct state new  accept
        udp  dport @udp_port_in  ct state new  accept

        tcp dport @tcp_scan_ports drop
        udp dport @udp_scan_ports drop

        # count and drop any other traffic
        counter  log prefix "Drop_in "  drop
}

chain inet main output {
        type filter  hook output  priority 0;

        # accept any localhost traffic
        oif lo  accept

        ct state established,related  accept
        ct state invalid  log prefix "Invalid_out "  drop

        # accept neighbour discovery otherwise IPv6 connectivity breaks.
        ip6 nexthdr icmpv6  icmpv6 type { nd-neighbor-solicit,  nd-router-advert, nd-neighbor-advert }  accept

        # accept ping
        ip protocol icmp  icmp type { echo-request }  accept

        tcp  dport @tcp_port_out  ct state new accept
        udp  dport @udp_port_out  ct state new accept

        counter  log prefix "Drop_out "  drop
}

Warning Warning: Double check the port for SSH before activating the script.

Activation Scripts

/etc/nftables.conf

Edit file /etc/nftables.conf

#!/usr/sbin/nft -f

flush ruleset

include "/etc/nftables/main.conf"

This file is executed when you start nftables. You can also manually execute it without issue.

/etc/nftables/reload_main.conf

This script is used to reload only the main table without the others. The point is to integrate with tools like Fail2Ban which are inserting rules in the firewall. By reloading just the main table, you can activate your new rules without impacting Fail2Ban.

Create file /etc/nftables/reload_main.conf

#!/usr/sbin/nft -f

delete table inet main

include "/etc/nftables/main.conf"

and make it executable

# chmod +x /etc/nftables/reload_main.conf

Enable

Warning Warning: It is recommended that you test your firewall before enabling it at boot time. An incorrectly configured firewall can lock you out of your machine.

# systemctl enable nftables

It the script output `update-rc.d: error: nftables Default-Start contains no runlevels, aborting.`, don’t worry. The firewall is correctly enabled in systemd. This is bug #804648.