Nftables : Enable Service2022/10/06 |
|
This is the Basic Operation of Nftables.
|
|
| [1] | On Ubuntu 22.04, nftables is used as the default UFW backend. |
|
root@dlp:~# update-alternatives --config iptables There are 2 choices for the alternative iptables (providing /usr/sbin/iptables). Selection Path Priority Status ------------------------------------------------------------ * 0 /usr/sbin/iptables-nft 20 auto mode 1 /usr/sbin/iptables-legacy 10 manual mode 2 /usr/sbin/iptables-nft 20 manual mode Press <enter> to keep the current choice[*], or type selection number: |
| [2] | If you use nftables directly, disable UFW service to avoid that the different firewall services influence each other. Furthermore, enable nftables.service that restores filtering ruleset when system restarts. |
|
root@dlp:~# systemctl disable --now ufw Synchronizing state of ufw.service with SysV service script with /lib/systemd/systemd-sysv-install. Executing: /lib/systemd/systemd-sysv-install disable ufw Removed /etc/systemd/system/multi-user.target.wants/ufw.service.root@dlp:~# systemctl enable --now nftables Created symlink /etc/systemd/system/sysinit.target.wants/nftables.service → /lib/systemd/system/nftables.service. # [nftables.service] restores ruleset from [/etc/nftables.conf] root@dlp:~# systemctl cat nftables.service # /lib/systemd/system/nftables.service [Unit] Description=nftables Documentation=man:nft(8) http://wiki.nftables.org Wants=network-pre.target Before=network-pre.target shutdown.target Conflicts=shutdown.target DefaultDependencies=no [Service] Type=oneshot RemainAfterExit=yes StandardInput=null ProtectSystem=full ProtectHome=true ExecStart=/usr/sbin/nft -f /etc/nftables.conf ExecReload=/usr/sbin/nft -f /etc/nftables.conf ExecStop=/usr/sbin/nft flush ruleset [Install] WantedBy=sysinit.target # [/etc/nftables.conf] has no filtering setting by default root@dlp:~# cat /etc/nftables.conf
#!/usr/sbin/nft -f
flush ruleset
table inet filter {
chain input {
type filter hook input priority 0;
}
chain forward {
type filter hook forward priority 0;
}
chain output {
type filter hook output priority 0;
}
}
|
| [3] | If you switch to nftables service with using the ruleset configured on UFW, configure like follows. |
|
# confirm current UFW rules ( based on that ufw is running ) root@dlp:~# ufw status verbose Status: active Logging: on (low) Default: deny (incoming), allow (outgoing), disabled (routed) New profiles: skip To Action From -- ------ ---- 22/tcp ALLOW IN Anywhere 80/tcp ALLOW IN Anywhere 443 ALLOW IN Anywhere 22/tcp (v6) ALLOW IN Anywhere (v6) 80/tcp (v6) ALLOW IN Anywhere (v6) 443 (v6) ALLOW IN Anywhere (v6) # output the current ruleset to [/etc/nftables.conf] root@dlp:~# iptables-save > ufw-rules.dump root@dlp:~# iptables-restore-translate -f ufw-rules.dump > ruleset.nft root@dlp:~# nft flush ruleset root@dlp:~# nft -f ruleset.nft root@dlp:~# nft list ruleset > /etc/nftables.conf
# stop ufw & start nftables root@dlp:~# systemctl disable --now ufw root@dlp:~# systemctl enable --now nftables
# show ruleset root@dlp:~# nft list ruleset
table ip filter {
chain INPUT {
type filter hook input priority filter; policy drop;
counter packets 3 bytes 228 jump ufw-before-logging-input
counter packets 3 bytes 228 jump ufw-before-input
counter packets 0 bytes 0 jump ufw-after-input
counter packets 0 bytes 0 jump ufw-after-logging-input
counter packets 0 bytes 0 jump ufw-reject-input
counter packets 0 bytes 0 jump ufw-track-input
}
chain FORWARD {
type filter hook forward priority filter; policy drop;
counter packets 0 bytes 0 jump ufw-before-logging-forward
counter packets 0 bytes 0 jump ufw-before-forward
counter packets 0 bytes 0 jump ufw-after-forward
.....
.....
# for example, it's possible to show settings of allowed services on [UFW] like follows root@dlp:~# nft list chain ip filter ufw-user-input
table ip filter {
chain ufw-user-input {
tcp dport 22 counter packets 0 bytes 0 accept
tcp dport 80 counter packets 0 bytes 0 accept
tcp dport 443 counter packets 0 bytes 0 accept
udp dport 443 counter packets 0 bytes 0 accept
}
}
|
| Sponsored Link |