Arturo: fix example

2018-06-01T11:10:55Z

fix example

@@ Line 17: / Line 17: @@
 include "./defines.nft"
 table inet filter {
          include "./inet-filter-sets.nft"
          include "./inet-filter-forward.nft"

Arturo: Add page. People ask me about this.

2016-12-23T13:12:42Z

Add page. People ask me about this.

New page

This example assumes a classic perimetral firewall, which is connected to 3 networks: internet, DMZ, and workstation LAN.

You could either put your ruleset all in the same file or split it in different text files for better maintenance.

In this example we will use several files:

* ruleset.nft (core nftables file, the one you load with '''nft -f''')
* defines.nft (definitions used in the other files)
* inet-filter-sets.nft (sets and maps definitions)
* inet filter-forward.nft (the forward chains and rules)
* inet-filter-local.nft (the local chains and rules)

File '''ruleset.nft''':
<source>
flush ruleset

include "./defines.nft"

chain global {
ct state established,related accept
ct state invalid drop
ip protocol icmp accept
ip6 nexthdr icmpv6 accept
udp dport 53 accept
}

table inet filter {
include "./inet-filter-sets.nft"
include "./inet-filter-forward.nft"
include "./inet-filter-local.nft"
}
</source>

File '''defines.nft''':
<source>
# interfaces
define nic_inet = bond0
define nic_dmz = bond1
define nic_lan = bond2

# network ranks
define net_ipv4_dmz = 10.0.1.0/24
define net_ipv6_dmz = fe00:1::/64
define net_ipv4_lan = 10.0.2.0/24
define net_ipv6_lan = fe00:2::/64

# some machines
define server1_ipv4 = 10.0.1.2
define server1_ipv6 = fe00:1::2
define workstation1_ipv4 = 10.0.2.2
define workstation1_ipv6 = fe00:2::2
</source>

File '''inet-filter-sets.nft''':
<source>
set myset_ipv4 {
type ipv4_addr;
elements = { $server1_ipv4 , $workstation1_ipv4 }
}

set myset_ipv6 {
type ipv6_addr;
elements = { $server1_ipv6 , $workstation1_ipv6 }
}
</source>

File '''inet-filter-forward.nft''':
<source>
chain dmz_in {
# your rules for traffic to your dmz servers
ip saddr @myset_ipv4
ip6 saddr @myset_ipv6
}

chain dmz_out {
# your rules for traffic from the dmz to internet
}

chain lan_in {
# your rules for traffic to your LAN nodes
}

chain lan_out {
# your rules for traffic from the LAN to the internet
}

chain forward {
type filter hook forward priority 0; policy drop;
jump global
oifname vmap { $nic_dmz : jump dmz_in , $nic_lan : jump lan_in }
oifname $nic_inet iifname vmap { $nic_dmz : jump dmz_out , $nic_lan : jump lan_out }
}
</source>

File '''inet-filter-local.nft''':
<source>
chain input {
type filter hook input priority 0 ; policy drop;
jump global
# your rules for traffic to the firewall here
}

chain output {
type filter hook output priority 0 ; policy drop;
jump global
# your rules for traffic originated from the firewall itself here
}
</source>

As all of these are plan text files, you can even think of maintaining them with some kind of control version (example here: https://github.com/aborrero/nftables-managed-with-git)

Classic perimetral firewall example - Revision history

Arturo: fix example

Arturo: Add page. People ask me about this.