Main Page: Difference between revisions
Jump to navigation
Jump to search
m (→Examples) |
|||
| Line 85: | Line 85: | ||
* [[Classic perimetral firewall example]] | * [[Classic perimetral firewall example]] | ||
* [[Port knocking example]] | * [[Port knocking example]] | ||
* [[Classification to tc structure example]] - WIP | |||
= Development progress = | = Development progress = | ||
Revision as of 11:58, 13 April 2019
Welcome to the nftables HOWTO documentation page. Here you will find documentation on how to build, install, configure and use nftables.
If you have any suggestion to improve it, please send your comments to Netfilter users mailing list <netfilter@vger.kernel.org>.
Introduction
- What is nftables?
- Why nftables?
- Main differences with iptables
- Netfilter hooks and integration with existing Netfilter components.
- Adoption
- Legacy xtables tools
Getting started
- Building and installing nftables from sources
- Using nftables from distributions
- Troubleshooting and FAQ
- Quick reference, nftables in 10 minutes
- Understanding nftables families
Basic operation
- Configuring tables
- Configuring chains
- Simple rule management
- Atomic rule replacement
- Error reporting from the command line
- Building rules through expressions
- Operations at ruleset level
- Monitoring ruleset updates
- Scripting
- Ruleset debug/tracing
- Moving from iptables to nftables
- Moving from ipset to nftables
Supported selectors for packet matching
- Matching packet header fields
- Matching packet metainformation
- Matching connection tracking stateful metainformation
- Rate limiting matchings
- Routing information
Possible actions on packets
- Accepting and dropping packets
- Jumping to chain
- Rejecting traffic
- Logging traffic
- Performing Network Address Translation (NAT)
- Setting packet metainformation
- Queueing to userspace
- Duplicating packets
- Mangle packet header fields
- Mangle TCP options
- Counters
- Load balancing
- Setting packet connection tracking metainformation
Note that, unlike iptables, you can perform several actions in one single rule.
Advanced data structures for performance packet classification
You will have to redesign your rule-set to benefit from these new nice features:
- Sets
- Dictionaries
- Intervals
- Maps
- Concatenations
- Metering (formerly known as flow tables before nftables 0.8.1 release)
- Updating sets from the packet path
- Element timeouts
- Math operations
- Stateful objects
If you are already using ipset in your iptables rule-set, that transition may be a bit more simple to you.
Examples
- Simple ruleset for a workstation
- Bridge filtering
- Multiple NATs using nftables maps
- Classic perimetral firewall example
- Port knocking example
- Classification to tc structure example - WIP
Development progress
- List of updates since Linux kernel 3.13
- Supported features compared to {ip,ip6,eb,arp}tables
- List of available translations via iptables-translate tool
External links
Watch some videos:
- Watch Getting a grasp of nftables, thanks to NLUUG association for recording this.
- Watch The ultimate packet classifier for GNU/Linux, thanks to the FSFE for paying my trip to Barcelona and for recommending me as speaker to the KDE Spanish branch.
- Florian Westphal - Why nftables?
- Watch Netdev 2.1 - Netfilter workshop
- Watch Netdev 2.2 - Netfilter mini-workshop
- Watch Netdev 0x12 - Netfilter mini-workshop
- Watch NLUUG - Goodbye iptables, Hello nftables
- Watch LCA2018 - nftables from a user perspective
Additional documentations and articles:
- Tutorial Extending nftables by Xiang Gao
- Article New in Debian stable Stretch: nftables
Thanks
To the NLnet foundation for initial sponsorship of this HOWTO:
To Eric Leblond, for boostrapping the Nftables quick howto in 2013.