Main Page: Difference between revisions

From nftables wiki
Jump to navigation Jump to search
m (→‎Getting started: Fix link format)
(Added a couple of sections and reorganized links for better flow. Eliminated a little redundant cruft.)
Line 2: Line 2:


If you have any suggestion to improve it, please send your comments to Netfilter users mailing list <netfilter@vger.kernel.org>.
If you have any suggestion to improve it, please send your comments to Netfilter users mailing list <netfilter@vger.kernel.org>.


= [[News]] =
= [[News]] =


= Introduction =
= Introduction =
* [[What is nftables?]]
* [[What is nftables?]]
* [[Netfilter hooks]] and integration with existing Netfilter components.
* [[Legacy xtables tools]]
* [[How to obtain help/support]]
* [[How to obtain help/support]]


= Getting started =


* [[Building and installing nftables from sources]]
= Reference =
* [[nftables from distributions|Using nftables from distributions]]
* [[Troubleshooting|Troubleshooting and FAQ]]
* [[Quick reference-nftables in 10 minutes|Quick reference, nftables in 10 minutes]]
* [[Quick reference-nftables in 10 minutes|Quick reference, nftables in 10 minutes]]
* [[Netfilter hooks]] and integration with existing Netfilter components.
* [[nftables families|Understanding nftables families]]
* [[nftables families|Understanding nftables families]]
* [[Troubleshooting|Troubleshooting and FAQ]]
= Installing nftables =
* [[nftables from distributions|Using nftables from distributions]]
* [[Building and installing nftables from sources]]
= Upgrading from xtables to nftables =
* [[Legacy xtables tools]]
* [[Moving from iptables to nftables]]
* [[Moving from ipset to nftables]]


= Basic operation =
= Basic operation =
* [[Configuring tables]]
* [[Configuring tables]]
* [[Configuring chains]]
* [[Configuring chains]]
Line 32: Line 41:
* [[Scripting]]
* [[Scripting]]
* [[Ruleset debug/tracing]]
* [[Ruleset debug/tracing]]
* [[Moving from iptables to nftables]]
* [[Moving from ipset to nftables]]
* [[Output text modifiers]]
* [[Output text modifiers]]


= Supported selectors for packet matching =
= Supported selectors for packet matching =
* [[Matching packet header fields]]
* [[Matching packet header fields]]
* [[Matching packet metainformation]]
* [[Matching packet metainformation]]
Line 43: Line 50:
* [[Rate limiting matchings]]
* [[Rate limiting matchings]]
* [[Routing information]]
* [[Routing information]]


= Possible actions on packets =
= Possible actions on packets =
* [[Accepting and dropping packets]]
* [[Accepting and dropping packets]]
* [[Jumping to chain]]
* [[Jumping to chain]]
Line 61: Line 68:
* [[Setting packet connection tracking metainformation]]
* [[Setting packet connection tracking metainformation]]


Note that, unlike ''iptables'', you can perform several actions in one single rule.


= Advanced data structures for performance packet classification =
= Advanced data structures for performance packet classification =
You will have to redesign your rule-set to benefit from these new nice features:
* [[Sets]]
* [[Sets]]
* [[Intervals]]
* [[Intervals]]
Line 79: Line 82:
* [[Flowtable]] (the fastpath network stack bypass)
* [[Flowtable]] (the fastpath network stack bypass)


If you are already using [[ipset]] in your ''iptables'' rule-set, that transition may be a bit more simple to you.


= Examples =
= Examples =
* [[Simple ruleset for a workstation]]
* [[Simple ruleset for a workstation]]
* [[Simple ruleset for a server]]
* [[Simple ruleset for a server]]
Line 92: Line 93:
* [[Using configuration management systems]] (like puppet, ansible, etc)
* [[Using configuration management systems]] (like puppet, ansible, etc)
* [[GeoIP matching]]
* [[GeoIP matching]]


= Development =
= Development =
Line 103: Line 105:
* [[Supported features compared to xtables|Supported features compared to {ip,ip6,eb,arp}tables]]
* [[Supported features compared to xtables|Supported features compared to {ip,ip6,eb,arp}tables]]
* [[List of available translations via iptables-translate tool]]
* [[List of available translations via iptables-translate tool]]


= External links =
= External links =
Line 126: Line 129:
* Article [http://ral-arturo.org/2017/05/05/debian-stretch-stable-nftables.html New in Debian stable Stretch: nftables]
* Article [http://ral-arturo.org/2017/05/05/debian-stretch-stable-nftables.html New in Debian stable Stretch: nftables]
* Article [https://ral-arturo.org/2020/11/22/python-nftables-tutorial.html How to use nftables from python] and git repository [https://github.com/aborrero/python-nftables-tutorial python-nftables-tutorial.git]
* Article [https://ral-arturo.org/2020/11/22/python-nftables-tutorial.html How to use nftables from python] and git repository [https://github.com/aborrero/python-nftables-tutorial python-nftables-tutorial.git]


= Thanks =
= Thanks =

Revision as of 16:10, 2 April 2021

Welcome to the nftables HOWTO documentation page. Here you will find documentation on how to build, install, configure and use nftables.

If you have any suggestion to improve it, please send your comments to Netfilter users mailing list <netfilter@vger.kernel.org>.


News

Introduction


Reference


Installing nftables


Upgrading from xtables to nftables


Basic operation


Supported selectors for packet matching


Possible actions on packets


Advanced data structures for performance packet classification


Examples


Development

Check Portal:DeveloperDocs - documentation for netfilter developers.

Some hints on the general development progress:


External links

Watch some videos:

Watch videos to track updates:

Additional documentations and articles:


Thanks

To the NLnet foundation for initial sponsorship of this HOWTO:

logo.gif

To Eric Leblond, for boostrapping the Nftables quick howto in 2013.