Ruleset debug/tracing - Revision history

Arturo: add see also section with external links

2024-10-16T13:13:50Z

add see also section with external links

← Older revision		Revision as of 13:13, 16 October 2024
Line 118:		Line 118:

	Then, the packet travel through the ruleset.		Then, the packet travel through the ruleset.

			= See also =

			Some external tools can automate all the steps described here, see:
			* https://github.com/aborrero/nftables-tracer (python based)
			* https://github.com/aojea/nftrace (golang based)

2020-11-04T01:06:22Z

Enabling nftrace

← Older revision		Revision as of 01:06, 4 November 2020
Line 17:		Line 17:

	Of course, you may only enable nftrace for a given matching packet.		Of course, you may only enable nftrace for a given matching packet.
	In the example below, we only enable nftrace for tcp packets ~~using the loopback interface~~:		In the example below, we only enable nftrace for tcp packets:

	<source lang="bash">		<source lang="bash">

2020-10-28T22:16:05Z

Complete example

← Older revision		Revision as of 22:16, 28 October 2020
Line 85:		Line 85:
	</source>		</source>

	This ~~register~~ the ''trace_chain'' before the existing ''input'' chain.		This registers the ''trace_chain'' before the existing ''input'' chain.

	And the rule to enable the tracing:		And the rule to enable the tracing:

2020-10-28T22:15:49Z

Complete example

← Older revision		Revision as of 22:15, 28 October 2020
Line 82:		Line 82:

	<source lang="bash">		<source lang="bash">
	% nft add chain ip filter trace_chain { type filter hook prerouting priority -~~600~~\; }		% nft add chain ip filter trace_chain { type filter hook prerouting priority -1\; }
	</source>		</source>

			This register the ''trace_chain'' before the existing ''input'' chain.

	And the rule to enable the tracing:		And the rule to enable the tracing:

2020-10-28T22:14:36Z

Use a chain to enable tracing

← Older revision		Revision as of 22:14, 28 October 2020
Line 36:		Line 36:
	</source>		</source>

	~~Assuming~~ you have an existing raw prerouting chain (at priority -300), ~~you can register~~ this trace chain right before this chain (at priority -301).		This example assumes you have an existing raw prerouting chain (at priority -300), hence, this is registering a trace chain right before this chain (at priority -301).

	Once you are done with rule tracing, you can just delete this chain to disable it:		Once you are done with rule tracing, you can just delete this chain to disable it:

2020-10-28T22:14:00Z

Use a chain to enable tracing

← Older revision		Revision as of 22:14, 28 October 2020
Line 27:		Line 27:
	= Use a chain to enable tracing =		= Use a chain to enable tracing =

	The recommended way ~~to go is~~ to enable tracing is to add a chain for this purpose.		The recommended way to enable tracing is to add a chain for this purpose.

	Register a ''trace_chain'' to enable tracing. If you already have a prerouting chain, then make sure your ''trace_chain'' priority comes ''before'' your existing prerouting chain.		Register a ''trace_chain'' to enable tracing. If you already have a prerouting chain, then make sure your ''trace_chain'' priority comes ''before'' your existing prerouting chain.

2020-10-28T22:13:43Z

Use a chain to enable tracing

← Older revision		Revision as of 22:13, 28 October 2020
Line 29:		Line 29:
	The recommended way to go is to enable tracing is to add a chain for this purpose.		The recommended way to go is to enable tracing is to add a chain for this purpose.

	Register a ''trace_chain'' ~~chain at priority -600 which contains a rule~~ to enable tracing.		Register a ''trace_chain'' to enable tracing. If you already have a prerouting chain, then make sure your ''trace_chain'' priority comes ''before'' your existing prerouting chain.

	<source lang="bash">		<source lang="bash">
	% nft add chain filter trace_chain { type filter hook prerouting priority -~~600~~\; }		% nft add chain filter trace_chain { type filter hook prerouting priority -301\; }
	% nft add rule filter trace_chain meta nftrace set 1		% nft add rule filter trace_chain meta nftrace set 1
	</source>		</source>

	~~Note that, if~~ you ~~already~~ have a prerouting chain, ~~then make sure the ''trace_chain'' priority comes ''~~before~~'' your existing prerouting~~ chain.		Assuming you have an existing raw prerouting chain (at priority -300), you can register this trace chain right before this chain (at priority -301).

	Once you are done with rule tracing, you can just delete this chain to disable it:		Once you are done with rule tracing, you can just delete this chain to disable it:

2020-10-28T21:52:09Z

enabling nftrace

← Older revision		Revision as of 21:52, 28 October 2020
Line 7:		Line 7:
	* monitor the trace events from the nft tool		* monitor the trace events from the nft tool

	= ~~enabling~~ nftrace =		= Enabling nftrace =

	To enable nftrace in a packet, use a rule with this statement:		To enable nftrace in a packet, use a rule with this statement:

2020-10-28T21:51:34Z

Use a chain to enable tracing

← Older revision		Revision as of 21:51, 28 October 2020
Line 27:		Line 27:
	= Use a chain to enable tracing =		= Use a chain to enable tracing =

	The recommended way to go is to enable tracing is to add a chain.		The recommended way to go is to enable tracing is to add a chain for this purpose.

	~~For this purpose, register~~ a ''trace_chain'' chain at priority -600 which contains a rule to enable tracing.		Register a ''trace_chain'' chain at priority -600 which contains a rule to enable tracing.

	<source lang="bash">		<source lang="bash">

2020-10-28T21:51:10Z

Use a chain to enable tracing

← Older revision		Revision as of 21:51, 28 October 2020
Line 27:		Line 27:
	= Use a chain to enable tracing =		= Use a chain to enable tracing =

	The recommended way to go is to enable tracing ~~on demand~~ to ~~debug your ruleset~~.		The recommended way to go is to enable tracing is to add a chain.

	For this purpose, register a ''trace_chain'' chain at priority -600 which contains a rule to enable tracing.		For this purpose, register a ''trace_chain'' chain at priority -600 which contains a rule to enable tracing.