Nftables Part 1

Introduction

STILL NOT COMPLETE Iptables (and its sister ip6tables as) or programs based upon it has for many years been the standard firewall product for Linux machines. Its reign is coming to an end. Debian has announced that the next incarnation of its OS (Debian 10) will see its replacement by nftables. Current kernels already have the nftables engine powering their firewalls with iptables and firewalld rulesets running on this. Nftables offers many new features, incuding simpler syntax, integration of all the old xtables family into one unified package. It has reached a stage of development and maturity that now is the time to make the move Having replaced iptables I have produced the guide below as an aid to those considering it. This is based on my experience with Debian 9 and kernel 4.9.0-8-amd64 other distributions will vary slightly especially in methods of installation. The other thing to note is that nft the front end requires root (or sudo su)

Getting and installing

The stretch repository contains nftables but a more recent version is available from stretch-backports, and as there has been a lot of recent development, this is the one to go for. If the backports repository is not in your sources.list then it will need to be added before you can install

 ~# echo "deb http://ftp.debian.org/debian stretch-backports main" >> /etc/apt/sources.list
~# apt-get update
~# apt-get -t stretch-backports install nftables

This will install all that is necessary. It sets up a new service nftables.service which is disabled on installation. That allows you to set up rules etc and clear iptables before you start.(It is not recommended to run both at the same time) On starting or restarting the service loads a minimalist ruleset, so we need to build our rules before running it.

The basic structure is the same as iptables – tables hold chains which are, in turn, containers for rules. The major difference is that iptables has tables predefined but nft has none. /etc/nftables.conf sets up a basic table and 3 empty chains which we will need to edit

 #!/usr/sbin/nft -f

flush ruleset

table inet filter {
        chain input {
                type filter hook input priority 0;
        }
        chain forward {
                type filter hook forward priority 0;
        }
        chain output {
                type filter hook output priority 0;
        }
}

The table and chains can have any name you like (there are length restrictions though), but these names are descriptive, they do what they say on the can. My VPS does not act as a router at the moment so I can safely remove the forward chain. The easiest way to do that is edit the file, I could of course use a command line instruction to do it. But we will look at that later. The other thing that needs doing is setting the policy for each chain. Again I will just do this by editing the file.

~#nano /etc/nftables.conf

So it will end up looking like this:-

 #!/usr/sbin/nft -f

flush ruleset

table inet filter {
        chain input {
                type filter hook input priority 0;policy accept;
        }
        chain output {
                type filter hook output priority 0;policy accept;
        }
}

So we save it. NOTE I have set the policy to accept, first time round I set it to drop and of course cut myself off.

And load it up

~# nft -f /etc/nftables.conf

No error messages means it was all OK. But we can check by using the command

~# nft list ruleset

There is now a ruleset in operation, albeit very sparse and in fact doing nothing to filter traffic. TO BE ADDED looking at the syntax and ways of adding, editing and deleting rules. References for more information etc.