Nftables : Enable Service2023/07/13

	This is the Basic Operation of Nftables.
[1]	Debian 12, nftables is used as the default UFW backend.

root@dlp:~#

update-alternatives --config iptables

There are 2 choices for the alternative iptables (providing /usr/sbin/iptables).

  Selection    Path                       Priority   Status
------------------------------------------------------------
* 0            /usr/sbin/iptables-nft      20        auto mode
  1            /usr/sbin/iptables-legacy   10        manual mode
  2            /usr/sbin/iptables-nft      20        manual mode

Press <enter> to keep the current choice[*], or type selection number:

[2]	If you use nftables directly, disable UFW service to avoid that the different firewall services influence each other. Furthermore, enable nftables.service that restores filtering ruleset when system restarts.

root@dlp:~#

systemctl disable --now ufw

Synchronizing state of ufw.service with SysV service script with /lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install disable ufw
Removed /etc/systemd/system/multi-user.target.wants/ufw.service.

root@dlp:~#

systemctl enable --now nftables

Created symlink /etc/systemd/system/sysinit.target.wants/nftables.service → /lib/systemd/system/nftables.service.

# [nftables.service] restores ruleset from [/etc/nftables.conf]

root@dlp:~#

systemctl cat nftables.service

# /lib/systemd/system/nftables.service
[Unit]
Description=nftables
Documentation=man:nft(8) http://wiki.nftables.org
Wants=network-pre.target
Before=network-pre.target shutdown.target
Conflicts=shutdown.target
DefaultDependencies=no

[Service]
Type=oneshot
RemainAfterExit=yes
StandardInput=null
ProtectSystem=full
ProtectHome=true
ExecStart=/usr/sbin/nft -f /etc/nftables.conf
ExecReload=/usr/sbin/nft -f /etc/nftables.conf
ExecStop=/usr/sbin/nft flush ruleset

[Install]
WantedBy=sysinit.target

# [/etc/nftables.conf] has no filtering setting by default

root@dlp:~#

cat /etc/nftables.conf

#!/usr/sbin/nft -f

flush ruleset

table inet filter {
        chain input {
                type filter hook input priority filter;
        }
        chain forward {
                type filter hook forward priority filter;
        }
        chain output {
                type filter hook output priority filter;
        }
}

[3]	If you switch to nftables service with using the ruleset configured on UFW, configure like follows.

# confirm current UFW rules ( based on that ufw is running )

root@dlp:~#

ufw status verbose

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    Anywhere
80/tcp                     ALLOW IN    Anywhere
2049/tcp                   ALLOW IN    Anywhere
22/tcp (v6)                ALLOW IN    Anywhere (v6)
80/tcp (v6)                ALLOW IN    Anywhere (v6)
2049/tcp (v6)              ALLOW IN    Anywhere (v6)

# output the current ruleset to [/etc/nftables.conf]

root@dlp:~#

iptables-save > ufw-rules.dump

root@dlp:~#

iptables-restore-translate -f ufw-rules.dump > ruleset.nft

root@dlp:~#

nft flush ruleset

root@dlp:~#

nft -f ruleset.nft

root@dlp:~#

nft list ruleset > /etc/nftables.conf

# stop ufw & start nftables

root@dlp:~#

systemctl disable --now ufw

root@dlp:~#

systemctl enable --now nftables

# show ruleset

root@dlp:~#

nft list ruleset

table ip filter {
        chain INPUT {
                type filter hook input priority filter; policy drop;
                counter packets 0 bytes 0 jump ufw-before-logging-input
                counter packets 0 bytes 0 jump ufw-before-input
                counter packets 0 bytes 0 jump ufw-after-input
                counter packets 0 bytes 0 jump ufw-after-logging-input
                counter packets 0 bytes 0 jump ufw-reject-input
                counter packets 0 bytes 0 jump ufw-track-input
                counter packets 0 bytes 0 jump ufw-before-logging-input
                counter packets 0 bytes 0 jump ufw-before-input
                counter packets 0 bytes 0 jump ufw-after-input
                counter packets 0 bytes 0 jump ufw-after-logging-input
                counter packets 0 bytes 0 jump ufw-reject-input
                counter packets 0 bytes 0 jump ufw-track-input
        }

        chain FORWARD {
                type filter hook forward priority filter; policy drop;
                counter packets 0 bytes 0 jump ufw-before-logging-forward
                counter packets 0 bytes 0 jump ufw-before-forward
.....
.....

# for example, it's possible to show settings of allowed services on [UFW] like follows

root@dlp:~#

nft list chain ip filter ufw-user-input

table ip filter {
        chain ufw-user-input {
                tcp dport 22 counter packets 0 bytes 0 accept
                tcp dport 80 counter packets 0 bytes 0 accept
                tcp dport 2049 counter packets 0 bytes 0 accept
        }
}

Matched Content