Setting packet connection tracking metainformation - Revision history

Fmyhr: Added section ct secmark set.

2021-04-16T16:53:42Z

Added section ct secmark set.

← Older revision		Revision as of 16:53, 16 April 2021
Line 118:		Line 118:
	}		}
	</source>		</source>


			== ''ct secmark set'' - Set conntrack secmark from packet secmark ==

			New in [https://marc.info/?l=netfilter&m=157532146917292&w=2 nftables 0.9.3], you can set a secmark on a conntrack entry from a packet secmark:
			<source>
			ct secmark set meta secmark
			</source>

			NOTE you cannot set the ct secmark to a constant value, you must set it from a matched packet as above.

2021-04-16T15:34:30Z

Linked ct timeout and ct expectation.

← Older revision		Revision as of 15:34, 16 April 2021
Line 76:		Line 76:
	</source>		</source>


			== [[Ct_timeout\|''ct timeout set'']] - Set conntrack timeout policy ==
			<br>
			<br>

			== [[Ct_expectation\|''ct expectation set'']] - Create a conntrack expectation ==
			<br>
			<br>

	== ''ct mark set'' - Set conntrack mark ==		== ''ct mark set'' - Set conntrack mark ==

2021-04-15T18:34:11Z

Reordered ct statements, consistent with ct expressions page.

@@ Line 82: / Line 82: @@
 <source>
 ct mark set meta mark
 </source>
@@ Line 117: / Line 109: @@
+     }
+}
 </source>

2021-04-14T15:38:58Z

Added ct set [mark, label, event, zone] sections.

@@ Line 1: / Line 1: @@
 You can set some bits of the packet [[Connection_Tracking_System | conntrack]] metainformation, as well as [[Matching connection tracking stateful metainformation | match on it]].
 == notrack ==
 You can use the ''notrack'' statement (added in Linux kernel 4.9, nftables 0.7) to explicitly skip connection tracking for matched packets. To be effective '''your ''notrack'' rule must come before conntrack is triggered'''. You can ensure this by attaching it to a base chain with [[Netfilter_hooks | ''prerouting'' hook]] and [[Configuring_chains#Base_chain_priority | priority]] < NF_IP_PRI_CONNTRACK (-200). Using ''raw'' priority (-300) is a good choice. The following example skips incoming traffic to tcp ports 80 (http) and 443 (https):
@@ Line 11: / Line 12: @@
 </source>
-== helpers ==
 You can assign each packet a [[Conntrack_helpers|conntrack helper]].
@@ Line 72: / Line 74: @@
 <source>
 net.netfilter.nf_conntrack_helper = 1
 </source>

2021-04-02T11:52:35Z

helpers: Linked Conntrack helpers page; should probably combine this section with that page.

← Older revision		Revision as of 11:52, 2 April 2021
Line 13:		Line 13:
	== helpers ==		== helpers ==

	You can assign each packet a conntrack helper.		You can assign each packet a [[Conntrack_helpers\|conntrack helper]].

	Instantiate a helper, using a named object:		Instantiate a helper, using a named object:

2021-02-15T14:29:34Z

notrack: rename example table to remove 'raw' that might be confused with priority

← Older revision		Revision as of 14:29, 15 February 2021
Line 6:		Line 6:

	<source lang="bash">		<source lang="bash">
	nft add table ~~my_raw_table~~		nft add table my_table
	nft add chain ~~my_raw_table~~ prerouting { type filter hook prerouting priority -300 \; }		nft add chain my_table prerouting { type filter hook prerouting priority -300 \; }
	nft add rule ~~my_raw_table~~ prerouting tcp dport { 80, 443 } notrack		nft add rule my_table prerouting tcp dport { 80, 443 } notrack
	</source>		</source>

2021-02-15T14:28:17Z

notrack: link netfilter hooks

← Older revision		Revision as of 14:28, 15 February 2021
Line 3:		Line 3:
	== notrack ==		== notrack ==

	You can use the ''notrack'' statement (added in Linux kernel 4.9, nftables 0.7) to explicitly skip connection tracking for ~~matching~~ packets. To be effective '''your ''notrack'' rule must come before conntrack is triggered'''. You can ensure this by attaching it to a base chain with [[Configuring_chains#Base_chain_priority \| priority]] < NF_IP_PRI_CONNTRACK (-200). Using ''raw'' priority (-300) is a good choice. The following example skips incoming traffic to tcp ports 80 (http) and 443 (https):		You can use the ''notrack'' statement (added in Linux kernel 4.9, nftables 0.7) to explicitly skip connection tracking for matched packets. To be effective '''your ''notrack'' rule must come before conntrack is triggered'''. You can ensure this by attaching it to a base chain with [[Netfilter_hooks \| ''prerouting'' hook]] and [[Configuring_chains#Base_chain_priority \| priority]] < NF_IP_PRI_CONNTRACK (-200). Using ''raw'' priority (-300) is a good choice. The following example skips incoming traffic to tcp ports 80 (http) and 443 (https):

	<source lang="bash">		<source lang="bash">

2021-02-15T12:52:56Z

notrack: Rewrote, combining examples and explaining choice of priority in detail.

← Older revision		Revision as of 12:52, 15 February 2021
Line 3:		Line 3:
	== notrack ==		== notrack ==

	You can use the '''notrack''~~' support~~ to explicitly skip connection tracking for matching packets.		You can use the ''notrack'' statement (added in Linux kernel 4.9, nftables 0.7) to explicitly skip connection tracking for matching packets. To be effective '''your ''notrack'' rule must come before conntrack is triggered'''. You can ensure this by attaching it to a base chain with [[Configuring_chains#Base_chain_priority \| priority]] < NF_IP_PRI_CONNTRACK (-200). Using ''raw'' priority (-300) is a good choice. The following example skips incoming traffic to tcp ports 80 (http) and 443 (https):

	~~The example below skips traffic for 80/tcp and 443/tcp:~~

	~~<source lang="bash">~~
	~~nft add~~ rule ~~ip raw prerouting tcp dport { 80, 443 } notrack~~
	~~</source>~~

	~~Please, note that you should use notrack~~ before ~~the kernel connection tracking~~ is triggered.
	~~Use~~ a chain with priority -300. ~~Example~~:

	<source lang="bash">		<source lang="bash">
	nft add table ~~raw~~		nft add table my_raw_table
	nft add chain ~~raw~~ prerouting { type filter hook prerouting priority -300 \; }		nft add chain my_raw_table prerouting { type filter hook prerouting priority -300 \; }
	nft add rule ~~raw~~ prerouting tcp dport 80 notrack		nft add rule my_raw_table prerouting tcp dport { 80, 443 } notrack
	</source>		</source>

	~~Support for this was added in linux kernel 4.9 and in nftables v0.7.~~

	== helpers ==		== helpers ==

2021-02-15T10:14:28Z

link Connection Tracking System; grammar

← Older revision		Revision as of 10:14, 15 February 2021
Line 1:		Line 1:
	You can set some bits of the packet conntrack metainformation, ~~apart of~~ [[Matching connection tracking stateful metainformation \| ~~matching~~ on it]].		You can set some bits of the packet [[Connection_Tracking_System \| conntrack]] metainformation, as well as [[Matching connection tracking stateful metainformation \| match on it]].

	== notrack ==		== notrack ==

2021-02-12T10:42:34Z

helpers: dictionary -> map

← Older revision		Revision as of 10:42, 12 February 2021
Line 60:		Line 60:
	</source>		</source>

	You can ~~of course~~ use a ~~dictionary, one single rule~~ to assign many helpers:		You can use a [[Maps \| map]] to assign many helpers using a single rule:

	<source>		<source>