{"id":210,"date":"2019-03-19T14:32:35","date_gmt":"2019-03-19T14:32:35","guid":{"rendered":"https:\/\/hostry.com\/blog\/?p=210"},"modified":"2019-04-12T06:33:11","modified_gmt":"2019-04-12T06:33:11","slug":"the-new-netfilter-linux-system-of-4-x-nftables","status":"publish","type":"post","link":"https:\/\/hostry.com\/blog\/the-new-netfilter-linux-system-of-4-x-nftables\/","title":{"rendered":"The new Netfilter Linux system of 4.x NFTables, a few simple tips for your server"},"content":{"rendered":"\n

In 2008, a new project has been introduced titled as nftables <\/strong>designed to replace for iptables <\/strong>administrators familiar linux. At the lapse of 10 years, it began to emerge in Linux distributives with core version later than 3.20 (debian, ubuntu, fedora)<\/strong>.<\/p>\n\n\n\n

In the middle of 2018, developers of NetFilter subsystem from Linux decided to consider iptables a legacy.  This has been announced on their Netfilter Workshop 2018 on June 16 (http:\/\/ral-arturo.org\/2018\/06\/16\/nfws2018.html<\/a>). <\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

There is every likelihood that in the future core revisions, the xt_ * modules development for iptables will be suspended with only hotfixes being acceptable. Instead, the developers will focus on the evolvement of a new nftables subsystem and functionality upgrade.<\/p>\n\n\n\n

Let us leave \u2018off screen\u2019<\/strong> those things about the time-proved \u2018old ox\u2019<\/strong> that did not sit well with the developers and simply take up enumerating new system\u2019s features visible to the administrators, i.e. the ultimate users familiar with the iptables:<\/p>\n\n\n\n

  • The absence of the usual built-in chains of algorithms and tables such as INPUT, FORWARD, OUTPUT,<\/strong> etc. The user specifies and names the tables (raw, filter, nat, mangle) and chains himself. For this you need a deeper understanding of the Netfilter <\/strong>system running and a more contemplative reading of a diagram in its documentation. It is possible to specify the customarily used chains with customary names, in which case the unused tables and algorithm chains in your firewall configuration simply will not occupy corememory space and thus save some CPU resources too.<\/li>
  • A built-in host of functions that is partially covering the ipset utility capabilities.<\/li>
  • A consolidation of iptables, ebtables, arptables, ip6tables in 1 utility with a single core and userspace codebase, which is essential for the users of KVM + Linux<\/strong> bridge visualization<\/strong> with complex anti-spoofing filters and MAC <\/strong>and IP whitelists<\/strong>.<\/li>
  • Packet and byte counters are optional and, if considered necessary, have to be specified explicitly – in the new terminology, it is a nonterminating action.<\/li>
  • Completely rewritten syntax, which can be considered as a plus as well as a minus depending on the standpoint, as will be referred to below.<\/li>
  • Covers about 75% of all the iptables modules host of functions. For more information visit https:\/\/wiki.nftables.org\/wiki-nftables\/index.php\/Supported_features_compared_to_xtables . Functional support is gradually increasing and new filter modules appear in the later versions of the core. <\/li><\/ul>\n\n\n\n

    New syntax drawbacks:<\/em><\/h2>\n\n\n\n
    • The necessity to learn another syntax, which takes up time. And you still need to remember both syntaxes, since the old one is still in use. This drawback is partially compensated by the iptables-translate program.<\/li>
    • <\/li><\/ul>\n\n\n\n

      Here are advantages of the new syntax, though it is not merely a syntax but also support for some things in the new core subsystem:<\/em><\/h2>\n\n\n\n
      • It is possible to carry out several non-terminating actions in one algorithm. For example, logging, adding an inside address to the list and only at the close a skip or drop (DROP) of a network packet. In a common IPTABLES for such cases we have to create a separate chain, in which all the 3 algorithms will have to be already added. It is obvious that these algorithms are trickier to read and they probably consume more resources.<\/li>
      • Numeric values (port numbers, even IP addresses) can be compared not only for equality but also for > , >=, <, <=. <\/li>
      • Built-in support for IP ranges.<\/li>
      • When reading from a file,  ‘include’ is possible<\/li>
      • A more readable (for novices) complex package filter writing, compare:<\/li><\/ul>\n\n\n\n

        iptables -A INPUT -p tcp -s 192.168.0.0\/24 -m conntrack –ctstate NEW -m muliport –dports 22:23,8081,873 -j REJECT –reject-with tcp-reset<\/span><\/p>\n\n\n\n

        and<\/strong><\/p>\n\n\n\n

        nft add rule filter INPUT ip saddr 192.168.0.0\/24 tcp dport {22-23, 8081 ,873} ct state new reject with tcp reset<\/span><\/p>\n\n\n\n

        Sure enough, the simple algorythms in iptables are  relatively easy to read for an IT specialist and are roughly evident from the context, but with complication the abundance of -m (–match) keys – <Long and pretty parameter> and arcane abbreviations look disheartening.<\/p>\n\n\n\n

        Algorithms can be written into a file in hierarchical logical blocks separated by \u201c{\u201d \u201c}\u201d \u201d, which can be found in such well-known products as nginx (Hello from JunOS world), the totall readability thus all the more increases:<\/p>\n\n\n\n

        table ip filter {\nchain INPUT {\ntype filter hook input priority 0; policy accept;\nip saddr 192.168.0.0\/24 tcp dport { ssh-telnet, rsync, tproxy} ct state new reject with tcp reset\n}\n}<\/code><\/pre>\n\n\n\n
        Simple tips for your Linux server<\/strong><\/h2>\n\n\n\n
         1) Save to file and restore algorithms:<\/strong><\/p>\n\n\n\n
        Analog iptables-save > iptables.save<\/span><\/p>\n\n\n\n
        # nft list ruleset > nftables.save<\/span><\/p>\n\n\n\n
        Analog iptables-restore < iptables.save<\/span><\/p>\n\n\n\n
        # nft -f nftables.save<\/span><\/p>\n\n\n\n
        In the beginning of the resulting algorithms you should preferably add this lineflush ruleset<\/span><\/p>\n\n\n\n
        otherwise, it is possible that the loaded algorithms will be added to the existing ones.<\/p>\n\n\n\n
        2) Transmission of the default supplier rule with CentOS 5\/6\/7 – the files contents and comparison with iptables.<\/strong><\/p>\n\n\n\n
        • NFTables (nft list ruleset)<\/strong><\/em><\/li><\/ul>\n\n\n\n
          flush ruleset\n\ntable ip filter {\n   chain INPUT {\n    type filter hook input priority 0; policy accept;\n    ct state established,related accept\n    ip protocol icmp accept\n    iif \"lo\" accept\n    tcp dport ssh accept\t\n    reject with icmp type host-prohibited\n   }\n   chain FORWARD {\n     type filter hook forward priority 0; policy accept;\n     reject with icmp type host-prohibited\n   }\n}<\/code><\/pre>\n\n\n\n
          • NFTables (nft list ruleset)<\/strong><\/em><\/li><\/ul>\n\n\n\n
            *filter\n:INPUT ACCEPT [0:0]\n:FORWARD ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT\n-A INPUT -p icmp -j ACCEPT\n-A INPUT -i lo -j ACCEPT\n-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT\n-A INPUT -j REJECT --reject-with icmp-host-prohibited\n-A FORWARD -j REJECT --reject-with icmp-host-prohibited\nCOMMIT\niptables (END)<\/code><\/pre>\n\n\n\n
            3) A web server with access via ssh for the white list IP 15.14.13.12, 132.12.10.5, access to MySQL from 15.14.13.12, 132.12.10.5, 172.16.1.12, 54.61.75.3, access to the web server is open to all, other ports are closed<\/strong><\/p>\n\n\n\n
            •   NFTables  (nft list ruleset)<\/em><\/strong><\/li><\/ul>\n\n\n\n
              flush ruleset\ntable ip filter {\n\tset ssh_white_list {\n\t\ttype ipv4_addr\n\t\telements = { 15.14.13.12, 132.12.10.5}\n\t}\n\tset mySQL_white_list {\n\t\ttype ipv4_addr\n\t\telements = { 15.14.13.12, 132.12.10.5, 172.16.1.12,\n54.61.75.3 }\n\t}\n\n\tchain INPUT {\n\t   type filter hook input priority 0; policy drop;\n\t   ct state established,related accept\n\t   iif \"lo\" accept\n\t   ip tcp dport {http, https } accept\n\t   ip saddr @ssh_white_list tcp dport ssh accept\n\t   ip saddr @mySQL_white_list tcp dport 3306 accept\n\t   ip protocol tcp reject with tcp reset\n\t}\n}<\/code><\/pre>\n\n\n\n
              •  IPSET (ipset list) <\/em><\/strong><\/li><\/ul>\n\n\n\n
                Name: ssh_white_list\nType: hash:net\nRevision: 6\nHeader: family inet hashsize 1024 maxelem 65536\nSize in memory: 480\nReferences: 0\nMembers:\n15.14.13.12\n132.12.10.5\n\nName: mySQL_white_list\nType: hash:net\nRevision: 6\nHeader: family inet hashsize 1024 maxelem 65536\nSize in memory: 608\nReferences: 0\nMembers:\n172.16.1.12\n54.61.75.3\n132.12.10.5\n15.14.13.12<\/code><\/pre>\n\n\n\n
                •  IPTABLES (iptables-save)<\/em><\/strong><\/li><\/ul>\n\n\n\n
                  *filter\n:INPUT ACCEPT [0:0]\n:FORWARD ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT\n-A INPUT -p icmp -j ACCEPT\n-A INPUT -i lo -j ACCEPT\n-A INPUT -p tcp -m set \u2014match-set ssh_white_list scr -m tcp --dport 22 -j ACCEPT\n-A INPUT -p tcp -m set \u2014match-set mySQL_white_list  scr -m tcp --dport 3306 -j ACCEPT\n-A INPUT -j REJECT --reject-with icmp-host-prohibited\n-A FORWARD -j REJECT --reject-with icmp-host-prohibited\nCOMMIT\niptables (END)<\/code><\/pre>\n\n\n\n
                  4) A simple gateway for accessing computers on a local network to the Internet through it using NAT to IP 15.16.17.18:<\/strong><\/p>\n\n\n\n
                  •   NFTables (nft list ruleset) <\/em><\/strong><\/li><\/ul>\n\n\n\n
                    flush ruleset\ntable ip nat {\n   chain POSTROUTING {\n\ttype filter hook postrouting priority 100; policy accept;\n\tip saddr 192.168.0.0\/24 counter oif \u00abeth1\u00bb snat to 15.16.17.18\n   }\n}<\/code><\/pre>\n\n\n\n
                    •   IPTABLES (iptables-save<\/strong><\/em>)<\/li><\/ul>\n\n\n\n
                      *nat\n:PREROUTING ACCEPT [1146:211488]\n:INPUT ACCEPT [30:7156]\n:OUTPUT ACCEPT [3:252]\n:POSTROUTING ACCEPT [3:252]\n-A POSTROUTING -s 192.168.0.0\/24 -j SNAT --to-source 15.16.17.18\nCOMMIT\n# Completed on Tue Feb 19 10:29:36 2019\n# Generated by iptables-save v1.6.0 on Tue Feb 19 10:29:36 2019\n*filter\n:INPUT ACCEPT [209:23149]\n:FORWARD ACCEPT [0:0]\n:OUTPUT ACCEPT [134:15650]\nCOMMIT<\/code><\/pre>\n\n\n\n
                      5) Port forwarding to a local server<\/strong>:<\/p>\n\n\n\n
                      • FTables (nft list ruleset<\/strong><\/em>)<\/li><\/ul>\n\n\n\n
                        flush ruleset\ntable ip nat {\n   chain PREROUTING {\n\ttype filter hook prerouting priority 100; policy accept;\n\tip daddr 15.16.17.18 tcp dport 8080 dnat to 192.168.0.15:80 \n    }\t\t\n}<\/code><\/pre>\n\n\n\n
                        • IPTABLES (iptables-save) <\/strong><\/em><\/li><\/ul>\n\n\n\n
                          *nat\n:PREROUTING ACCEPT [2:363]\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n:POSTROUTING ACCEPT [0:0]\n-A PREROUTING -d 15.16.17.18\/32 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.15:80\nCOMMIT\n*filter\n:INPUT ACCEPT [532:52024]\n:FORWARD ACCEPT [0:0]\n:OUTPUT ACCEPT [294:30682]\nCOMMIT<\/code><\/pre>\n\n\n\n
                          6) Examples 4 and 5 can be combined into:<\/strong><\/p>\n\n\n\n
                          •  FTables (nft list ruleset)<\/em><\/strong><\/li><\/ul>\n\n\n\n
                            flush ruleset\ntable ip nat {\n   chain POSTROUTING {\n\ttype filter hook postrouting priority 100; policy accept;\tip saddr 192.168.0.0\/24 counter oif \u00abeth1\u00bb snat to 15.16.17.18\n   }\t\t\n   chain PREROUTING {\n\ttype filter hook prerouting priority 100; policy accept;\n\tip daddr 15.16.17.18 tcp dport 8080 dnat to 192.168.0.15:80 \n\t}\n}<\/code><\/pre>\n\n\n\n
                            •   IPTABLES (iptables-save)<\/strong><\/em><\/li><\/ul>\n\n\n\n
                              *nat\n:PREROUTING ACCEPT [2:363]\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n:POSTROUTING ACCEPT [0:0]\n-A POSTROUTING -s 192.168.0.0\/24 -j SNAT --to-source 15.16.17.18\n-A PREROUTING -d 15.16.17.18\/32 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.15:80\nCOMMIT\n*filter\n:INPUT ACCEPT [532:52024]\n:FORWARD ACCEPT [0:0]\n:OUTPUT ACCEPT [294:30682]\nCOMMIT<\/code><\/pre>\n\n\n\n
                              In all the examples above, the titles of tables and chains (nat, filter, INPUT, PREROUTING, POSTROUTING) may have other meanings, as they are titled so for recognition of those well acquainted with legacy iptables. The ‘type filter hook postrouting priority 100; policy accept;’ lines at the beginning of the chains have real meaning for the algorithm operation. <\/p>\n","protected":false},"excerpt":{"rendered":"
                              In 2008, a new project has been introduced titled as nftables designed to replace for iptables administrators familiar linux. At the lapse of 10 years…<\/p>\n","protected":false},"author":1,"featured_media":325,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[15],"tags":[21,18,19,16,17,22],"class_list":["post-210","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux-server","tag-debian","tag-iptables","tag-linux-bridge-visualization","tag-linux-server","tag-netfilter-linux","tag-ubuntu"],"read_time":6,"_links":{"self":[{"href":"https:\/\/hostry.com\/blog\/wp-json\/wp\/v2\/posts\/210","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostry.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostry.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostry.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/hostry.com\/blog\/wp-json\/wp\/v2\/comments?post=210"}],"version-history":[{"count":24,"href":"https:\/\/hostry.com\/blog\/wp-json\/wp\/v2\/posts\/210\/revisions"}],"predecessor-version":[{"id":240,"href":"https:\/\/hostry.com\/blog\/wp-json\/wp\/v2\/posts\/210\/revisions\/240"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hostry.com\/blog\/wp-json\/wp\/v2\/media\/325"}],"wp:attachment":[{"href":"https:\/\/hostry.com\/blog\/wp-json\/wp\/v2\/media?parent=210"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostry.com\/blog\/wp-json\/wp\/v2\/categories?post=210"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostry.com\/blog\/wp-json\/wp\/v2\/tags?post=210"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}