Main Page: Difference between revisions

From nftables wiki
Jump to navigation Jump to search
(place update videos)
(very confusing presentation, remove it)
 
(44 intermediate revisions by 6 users not shown)
Line 2: Line 2:


If you have any suggestion to improve it, please send your comments to Netfilter users mailing list <netfilter@vger.kernel.org>.
If you have any suggestion to improve it, please send your comments to Netfilter users mailing list <netfilter@vger.kernel.org>.
= [[News]] =


= Introduction =
= Introduction =
* [[What is nftables?]]
* [[What is nftables?]]
* [[Why nftables?]]
* [[Main differences with iptables]]
* [[Netfilter hooks]] and integration with existing Netfilter components.
* [[Adoption]]
* [[Legacy xtables tools]]
* [[How to obtain help/support]]
* [[How to obtain help/support]]


= Getting started =


* [[Building and installing nftables from sources]]
= Reference =
* Using [[nftables from distributions]]
* [https://www.netfilter.org/projects/nftables/manpage.html man nft - netfilter website]
* [[Troubleshooting|Troubleshooting and FAQ]]
* [https://www.mankier.com/8/nft man nft - mankier.com]
* [[Quick reference-nftables in 10 minutes|Quick reference, nftables in 10 minutes]]
* [[Quick reference-nftables in 10 minutes|Quick reference, nftables in 10 minutes]]
* [[Netfilter hooks]] and nftables integration with existing Netfilter components
* [[nftables families|Understanding nftables families]]
* [[nftables families|Understanding nftables families]]
* [[Data_types|Data types]]
* [[Connection_Tracking_System|Connection tracking system (conntrack)]], used for stateful firewalling and NAT
* [[Troubleshooting|Troubleshooting and FAQ]]
* [[Further_documentation|Additional documentation]]
= Installing nftables =
* [[nftables from distributions|Using nftables from distributions]]
* [[Building and installing nftables from sources]]
= Upgrading from xtables to nftables =
* [[Legacy xtables tools]]
* [[Moving from iptables to nftables]]
* [[Moving from ipset to nftables]]


= Basic operation =
= Basic operation =
* [[Configuring tables]]
* [[Configuring tables]]
* [[Configuring chains]]
* [[Configuring chains]]
Line 33: Line 46:
* [[Scripting]]
* [[Scripting]]
* [[Ruleset debug/tracing]]
* [[Ruleset debug/tracing]]
* [[Moving from iptables to nftables]]
* [[Ruleset debug/VM code analysis]]
* [[Moving from ipset to nftables]]
* [[Output text modifiers]]
* [[Output text modifiers]]


= Supported selectors for packet matching =
= Expressions: Matching packets =
 
* [[Matching packet header fields]]
* [[Matching packet metainformation]]
* [[Matching packet metainformation]]
* [[Matching packet headers]]
* [[Matching connection tracking stateful metainformation]]
* [[Matching connection tracking stateful metainformation]]
* [[Matching routing information]]
* [[Rate limiting matchings]]
* [[Rate limiting matchings]]
* [[Routing information]]


= Possible actions on packets =


= Statements: Acting on packet matches =
* [[Accepting and dropping packets]]
* [[Accepting and dropping packets]]
* [[Rejecting traffic]]
* [[Jumping to chain]]
* [[Jumping to chain]]
* [[Rejecting traffic]]
* [[Counters]]
* [[Logging traffic]]
* [[Logging traffic]]
* [[Performing Network Address Translation (NAT)]]
* [[Performing Network Address Translation (NAT)]]
* [[Setting packet metainformation]]
* [[Setting packet metainformation]]
* [[Queueing to userspace]]
* [[Setting packet connection tracking metainformation]]
* [[Mangling packet headers]] (including stateless NAT)
* [[Duplicating packets]]
* [[Duplicating packets]]
* [[Mangle packet header fields]]
* [[Mangle TCP options]]
* [[Counters]]
* [[Load balancing]]
* [[Load balancing]]
* [[Setting packet connection tracking metainformation]]
* [[Queueing to userspace]]


Note that, unlike ''iptables'', you can perform several actions in one single rule.


= Advanced data structures for performance packet classification =
= Advanced data structures for performance packet classification =
You will have to redesign your rule-set to benefit from these new nice features:
* [[Sets]]
* [[Dictionaries]]
* [[Intervals]]
* [[Intervals]]
* [[Maps]]
* [[Concatenations]]
* [[Concatenations]]
* [[Meters|Metering]] (formerly known as flow tables before nftables 0.8.1 release)
* [[Updating sets from the packet path]]
* [[Element timeouts]]
* [[Math operations]]
* [[Math operations]]
* [[Stateful objects]]
* [[Stateful objects]]
* [[Flowtable]] (the fastpath network stack bypass)
** [[Counters]]
** [[Quotas]]
** [[Limits]]
** [[Connlimits]] (''ct count'')
* Other objects
** [[Conntrack helpers]] (''ct helper'', Layer 7 ALG)
** [[Ct_timeout|Conntrack timeout policies]] (''ct timeout'')
** [[Ct_expectation|Conntrack expectations]] (''ct expectation'')
** [[Synproxy]]
** [[Secmark|Secmarks]]
* Generic set infrastructure
** [[Sets]]
** [[Element timeouts]]
** [[Updating sets from the packet path]]
** [[Maps]]
** [[Verdict_Maps_(vmaps) | Verdict maps]]
** [[Meters|Metering]] (formerly known as flow tables before nftables 0.8.1)
* [[Flowtables]] (the fastpath network stack bypass)


If you are already using [[ipset]] in your ''iptables'' rule-set, that transition may be a bit more simple to you.


= Examples =
= Examples =
* [[Simple ruleset for a workstation]]
* [[Simple ruleset for a workstation]]
* [[Simple ruleset for a server]]
* [[Simple ruleset for a server]]
* [[Simple ruleset for a home router]]
* [[Bridge filtering]]
* [[Bridge filtering]]
* [[Multiple NATs using nftables maps]]
* [[Multiple NATs using nftables maps]]
Line 103: Line 119:
* [[Supported features compared to xtables|Supported features compared to {ip,ip6,eb,arp}tables]]
* [[Supported features compared to xtables|Supported features compared to {ip,ip6,eb,arp}tables]]
* [[List of available translations via iptables-translate tool]]
* [[List of available translations via iptables-translate tool]]


= External links =
= External links =
Line 112: Line 129:
* [https://www.youtube.com/watch?v=Sy0JDX451ns Florian Westphal - Why nftables?]
* [https://www.youtube.com/watch?v=Sy0JDX451ns Florian Westphal - Why nftables?]
* Watch [https://www.youtube.com/watch?v=0wQfSfDVN94 NLUUG - Goodbye iptables, Hello nftables]
* Watch [https://www.youtube.com/watch?v=0wQfSfDVN94 NLUUG - Goodbye iptables, Hello nftables]
* Watch [https://www.youtube.com/watch?v=Uf5ULkEWPL0 LCA2018 - nftables from a user perspective]


Watch videos to track updates:
Watch videos to track updates:


* Watch [https://www.youtube.com/watch?v=qXVOA2MKA1s Netdev 2.1 - Netfilter workshop]
* Watch [https://www.youtube.com/watch?v=qXVOA2MKA1s Netdev 2.1 - Netfilter mini-workshop (2017)]
* Watch [https://youtu.be/iCj10vEKPrw Netdev 2.2 - Netf‌ilter mini-workshop]
* Watch [https://youtu.be/iCj10vEKPrw Netdev 2.2 - Netf‌ilter mini-workshop (2018)]
* Watch [https://youtu.be/0hqfzp6tpZo Netdev 0x12 - Netf‌ilter mini-workshop
* Watch [https://youtu.be/0hqfzp6tpZo Netdev 0x12 - Netf‌ilter mini-workshop (2019)]
* Watch [https://yewtu.be/watch?v=GqGGo4svj7s - Netdev 0x14 - Netfilter Workshop]  
* Watch [https://www.youtube.com/watch?v=GqGGo4svj7s&feature=youtu.be Netdev 0x14 - Netfilter mini-Workshop (2020)]  


Additional documentations and articles:
Additional documentations and articles:
Line 125: Line 141:
* Tutorial [https://zasdfgbnm.github.io/2017/09/07/Extending-nftables/ Extending nftables by Xiang Gao]
* Tutorial [https://zasdfgbnm.github.io/2017/09/07/Extending-nftables/ Extending nftables by Xiang Gao]
* Article [http://ral-arturo.org/2017/05/05/debian-stretch-stable-nftables.html New in Debian stable Stretch: nftables]
* Article [http://ral-arturo.org/2017/05/05/debian-stretch-stable-nftables.html New in Debian stable Stretch: nftables]
* Article [https://ral-arturo.org/2020/11/22/python-nftables-tutorial.html How to use nftables from python] and git repository [https://github.com/aborrero/python-nftables-tutorial python-nftables-tutorial.git]


= Thanks =
= Thanks =

Latest revision as of 14:47, 12 October 2024

Welcome to the nftables HOWTO documentation page. Here you will find documentation on how to build, install, configure and use nftables.

If you have any suggestion to improve it, please send your comments to Netfilter users mailing list <netfilter@vger.kernel.org>.


News

Introduction


Reference


Installing nftables


Upgrading from xtables to nftables


Basic operation

Expressions: Matching packets


Statements: Acting on packet matches


Advanced data structures for performance packet classification


Examples

Development

Check Portal:DeveloperDocs - documentation for netfilter developers.

Some hints on the general development progress:


External links

Watch some videos:

Watch videos to track updates:

Additional documentations and articles:


Thanks

To the NLnet foundation for initial sponsorship of this HOWTO:

logo.gif

To Eric Leblond, for boostrapping the Nftables quick howto in 2013.

Retrieved from "http://wiki.nftables.org/wiki-nftables/index.php?title=Main_Page&oldid=1152"