Scripting - Revision history

Pablo: /* Including files */

2023-04-20T14:46:47Z

Including files

← Older revision		Revision as of 14:46, 20 April 2023
Line 57:		Line 57:

	# include all files in a given directory using an absolute path		# include all files in a given directory using an absolute path
	include "/etc/nftables/"		include "/etc/nftables/*"
	</source>		</source>

Fmyhr: Added section on using nftables from Python, with links to Arturo's tutorial pages.

2021-02-21T12:30:26Z

Added section on using nftables from Python, with links to Arturo's tutorial pages.

← Older revision		Revision as of 12:30, 21 February 2021
Line 139:		Line 139:
	= Building an ''nft'' file from scripts =		= Building an ''nft'' file from scripts =
	Though not necessarily recommended, you can use your choice of scripting language to build a single text file in a format accepted by ''nft'' (see previous section), and then load the firewall configuration atomically with ''nft -f <your_file_in_nft_format>''. You may want to use this method if you are coordinating your ''nft'' configuration with that of other subsystems that use different file formats and command-line tools.		Though not necessarily recommended, you can use your choice of scripting language to build a single text file in a format accepted by ''nft'' (see previous section), and then load the firewall configuration atomically with ''nft -f <your_file_in_nft_format>''. You may want to use this method if you are coordinating your ''nft'' configuration with that of other subsystems that use different file formats and command-line tools.

			= Using nftables from Python =
			The same functionality provided by the ''nft'' command-line utility is available from within Python programs via the high-level library libnftables. Please see the following for more information and examples:
			* [https://ral-arturo.org/2020/11/22/python-nftables-tutorial.html How to use nftables from Python], Arturo Borrero, 2020-11-22;
			* [https://github.com/aborrero/python-nftables-tutorial python nftables tutorial] code examples to accompany the above.

	= See also =		= See also =

Fmyhr: Added section noting ability to use script languages to construct nft-format file to be loaded atomically.

2021-02-20T14:32:48Z

Added section noting ability to use script languages to construct nft-format file to be loaded atomically.

← Older revision		Revision as of 14:32, 20 February 2021
Line 136:		Line 136:
	You can freely translate between the two formats, as the syntax is mostly the same (only the organization differs).		You can freely translate between the two formats, as the syntax is mostly the same (only the organization differs).
	Depending on your use case, you may want to use one format or other when building your firewall.		Depending on your use case, you may want to use one format or other when building your firewall.

			= Building an ''nft'' file from scripts =
			Though not necessarily recommended, you can use your choice of scripting language to build a single text file in a format accepted by ''nft'' (see previous section), and then load the firewall configuration atomically with ''nft -f <your_file_in_nft_format>''. You may want to use this method if you are coordinating your ''nft'' configuration with that of other subsystems that use different file formats and command-line tools.

	= See also =		= See also =

Nevola: /* Including files */ According to the comment, it was expected a directory not a file

2021-02-19T18:47:12Z

Including files: According to the comment, it was expected a directory not a file

← Older revision		Revision as of 18:47, 19 February 2021
Line 57:		Line 57:

	# include all files in a given directory using an absolute path		# include all files in a given directory using an absolute path
	include "/etc/nftables/~~myruleset.nft~~"		include "/etc/nftables/"
	</source>		</source>

Arturo: /* Including files */ rework section including more info, mostly extracted from the manpage

2019-07-30T14:56:24Z

Including files: rework section including more info, mostly extracted from the manpage

← Older revision		Revision as of 14:56, 30 July 2019
Line 34:		Line 34:
	= Including files =		= Including files =

	The ~~example below shows how~~ to include ~~other ruleset~~ files:		Other files can be included by using the include statement. The directories to be searched for include files can be specified using the '''-I/--includepath''' option. You can override this behavior either by prepending ‘./’ to your path to force inclusion of
			files located in the current working directory (i.e. relative path) or / for file location expressed as an absolute path.

			If '''-I/--includepath''' is not specified, then nft relies on the default directory that is specified at compile time. You can retrieve this default directory via '''-h/--help''' option.

			Include statements support the usual shell wildcard symbols (\*,?,[]). Having no matches for an include statement is not an error, if wildcard symbols are used in the include statement.

			This allows having potentially empty include directories for statements like include "/etc/firewall/rules/".
			The wildcard matches are loaded in alphabetical order.

			'''NOTE:''' Files beginning with dot (.) are not matched by include statements.


	<source lang="bash">		<source lang="bash">
	#!/usr/sbin/nft -f		#!/usr/sbin/nft -f

			# include a single file using the default search path
	include "ipv4-nat.ruleset"		include "ipv4-nat.ruleset"
	include "~~ipv6-nat~~.~~ruleset~~"
			# include all files ending in *.nft in the default search path
			include "*.nft"

			# include all files in a given directory using an absolute path
			include "/etc/nftables/myruleset.nft"
	</source>		</source>

Arturo: /* File formats */ extend a bit example

2018-03-10T13:14:48Z

File formats: extend a bit example

← Older revision		Revision as of 13:14, 10 March 2018
Line 88:		Line 88:

	<source lang="bash">		<source lang="bash">
			#!/usr/sbin/nft -f

			define ntp_servers = { 84.77.40.132, 176.31.53.99, 81.19.96.148, 138.100.62.8 }

	#flush table nat		#flush table nat
	table ip nat {		table ip nat {
	chain prerouting {		chain prerouting {
	type filter hook prerouting priority 0; policy accept;		type filter hook prerouting priority 0; policy accept;
			ip saddr $ntp_servers counter
	}		}

Arturo: /* File formats */ delete extra line which adds nothing to the example

2018-03-10T13:13:17Z

File formats: delete extra line which adds nothing to the example

← Older revision		Revision as of 13:13, 10 March 2018
Line 88:		Line 88:

	<source lang="bash">		<source lang="bash">
	~~create table ip nat~~
	#flush table nat		#flush table nat
	table ip nat {		table ip nat {

Arturo: add see also section

2018-02-01T10:35:38Z

add see also section

← Older revision		Revision as of 10:35, 1 February 2018
Line 115:		Line 115:
	You can freely translate between the two formats, as the syntax is mostly the same (only the organization differs).		You can freely translate between the two formats, as the syntax is mostly the same (only the organization differs).
	Depending on your use case, you may want to use one format or other when building your firewall.		Depending on your use case, you may want to use one format or other when building your firewall.

			= See also =

			This related information is very useful when dealing with nftables scripts:

			* [[Atomic rule replacement]]
			* [[Operations at ruleset level]]

Arturo: add section 'File formats', moved from the Atomic rule replacement article

2018-02-01T10:29:19Z

add section 'File formats', moved from the Atomic rule replacement article

← Older revision		Revision as of 10:29, 1 February 2018
Line 80:		Line 80:
	define google_dns = 8.8.8.8		define google_dns = 8.8.8.8
	</source>		</source>

			= File formats =

			''nft -f <filename>'' accepts 2 formats, the first is the format seen in the output of ''nft list table''. The second is using the same syntax of calling the ''nft'' binary several times, but in an atomic fashion.

			Example of nftables output format:

			<source lang="bash">
			create table ip nat
			#flush table nat
			table ip nat {
			chain prerouting {
			type filter hook prerouting priority 0; policy accept;
			}

			chain postrouting {
			type filter hook postrouting priority 100; policy accept;
			}
			}
			</source>

			Example of scripted config format:

			<source lang="bash">
			#!/usr/sbin/nft -f

			define ntp_servers = { 84.77.40.132, 176.31.53.99, 81.19.96.148, 138.100.62.8 }

			add table filter
			add chain filter input { type filter hook input priority 0; }
			add rule filter input ip saddr $ntp_servers counter
			</source>

			You can freely translate between the two formats, as the syntax is mostly the same (only the organization differs).
			Depending on your use case, you may want to use one format or other when building your firewall.

Duncan: Update all the other "#!" lines in line with the previous update

2017-11-19T07:08:32Z

Update all the other "#!" lines in line with the previous update

← Older revision		Revision as of 07:08, 19 November 2017
Line 14:		Line 14:

	<source lang="bash">		<source lang="bash">
	#!/usr/sbin/nft		#!/usr/sbin/nft -f

	#		#
Line 37:		Line 37:

	<source lang="bash">		<source lang="bash">
	#!/usr/sbin/nft		#!/usr/sbin/nft -f

	include "ipv4-nat.ruleset"		include "ipv4-nat.ruleset"
Line 48:		Line 48:

	<source lang="bash">		<source lang="bash">
	#!/usr/sbin/nft		#!/usr/sbin/nft -f

	define google_dns = 8.8.8.8		define google_dns = 8.8.8.8
Line 60:		Line 60:

	<source lang="bash">		<source lang="bash">
	#!/usr/sbin/nft		#!/usr/sbin/nft -f

	define ntp_servers = { 84.77.40.132, 176.31.53.99, 81.19.96.148, 138.100.62.8 }		define ntp_servers = { 84.77.40.132, 176.31.53.99, 81.19.96.148, 138.100.62.8 }