Difference between revisions of "Main Page"

From nftables wiki
Jump to: navigation, search
(Videos: rename section to 'External Links' and add more information)
(Development)
 
(30 intermediate revisions by 8 users not shown)
Line 1: Line 1:
 
Welcome to the ''nftables'' HOWTO documentation page. Here you will find documentation on how to build, install, configure and use nftables.
 
Welcome to the ''nftables'' HOWTO documentation page. Here you will find documentation on how to build, install, configure and use nftables.
 
This documentation was initially started by Eric Leblond, known as the [https://home.regit.org/netfilter-en/nftables-quick-howto/ nftables quick HOWTO], and it has been extended and enhanced by Pablo Neira Ayuso and a good bunch of contributors.
 
  
 
If you have any suggestion to improve it, please send your comments to Netfilter users mailing list <netfilter@vger.kernel.org>.
 
If you have any suggestion to improve it, please send your comments to Netfilter users mailing list <netfilter@vger.kernel.org>.
Line 11: Line 9:
 
* [[Main differences with iptables]]
 
* [[Main differences with iptables]]
 
* [[Netfilter hooks]] and integration with existing Netfilter components.
 
* [[Netfilter hooks]] and integration with existing Netfilter components.
 +
* [[Adoption]]
 +
* [[Legacy xtables tools]]
 +
* [[How to obtain help/support]]
  
 
= Getting started =
 
= Getting started =
Line 18: Line 19:
 
* [[Troubleshooting|Troubleshooting and FAQ]]
 
* [[Troubleshooting|Troubleshooting and FAQ]]
 
* [[Quick reference-nftables in 10 minutes|Quick reference, nftables in 10 minutes]]
 
* [[Quick reference-nftables in 10 minutes|Quick reference, nftables in 10 minutes]]
* [https://2nft.alemayhu.com/ Translate your iptables rules from a web app]
+
* [[nftables families|Understanding nftables families]]
  
 
= Basic operation =
 
= Basic operation =
Line 33: Line 34:
 
* [[Ruleset debug/tracing]]
 
* [[Ruleset debug/tracing]]
 
* [[Moving from iptables to nftables]]
 
* [[Moving from iptables to nftables]]
 +
* [[Moving from ipset to nftables]]
  
 
= Supported selectors for packet matching =
 
= Supported selectors for packet matching =
Line 53: Line 55:
 
* [[Duplicating packets]]
 
* [[Duplicating packets]]
 
* [[Mangle packet header fields]]
 
* [[Mangle packet header fields]]
 +
* [[Mangle TCP options]]
 
* [[Counters]]
 
* [[Counters]]
 
* [[Load balancing]]
 
* [[Load balancing]]
Line 68: Line 71:
 
* [[Maps]]
 
* [[Maps]]
 
* [[Concatenations]]
 
* [[Concatenations]]
* [[Flow tables]]
+
* [[Meters|Metering]] (formerly known as flow tables before nftables 0.8.1 release)
 
* [[Updating sets from the packet path]]
 
* [[Updating sets from the packet path]]
 
* [[Element timeouts]]
 
* [[Element timeouts]]
 
* [[Math operations]]
 
* [[Math operations]]
 
* [[Stateful objects]]
 
* [[Stateful objects]]
 +
* [[Flowtable]] (the fastpath network stack bypass)
  
 
If you are already using [[ipset]] in your ''iptables'' rule-set, that transition may be a bit more simple to you.
 
If you are already using [[ipset]] in your ''iptables'' rule-set, that transition may be a bit more simple to you.
Line 79: Line 83:
  
 
* [[Simple ruleset for a workstation]]
 
* [[Simple ruleset for a workstation]]
 +
* [[Simple ruleset for a server]]
 
* [[Bridge filtering]]
 
* [[Bridge filtering]]
 
* [[Multiple NATs using nftables maps]]
 
* [[Multiple NATs using nftables maps]]
 
* [[Classic perimetral firewall example]]
 
* [[Classic perimetral firewall example]]
 +
* [[Port knocking example]]
 +
* [[Classification to tc structure example]]
 +
* [[Using configuration management systems]] (like puppet, ansible, etc)
 +
* [[GeoIP matching]]
 +
 +
= Development =
 +
 +
Check [[Portal:DeveloperDocs|Portal:DeveloperDocs - documentation for netfilter developers]].
  
= Development progress =
+
Some hints on the general development progress:
  
 
* [[List of updates since Linux kernel 3.13]]
 
* [[List of updates since Linux kernel 3.13]]
 +
* [[List of updates in the nft command line tool]]
 
* [[Supported features compared to xtables|Supported features compared to {ip,ip6,eb,arp}tables]]
 
* [[Supported features compared to xtables|Supported features compared to {ip,ip6,eb,arp}tables]]
 
* [[List of available translations via iptables-translate tool]]
 
* [[List of available translations via iptables-translate tool]]
Line 94: Line 108:
  
 
* Watch [https://www.youtube.com/watch?v=FXTRRwXi3b4 Getting a grasp of nftables], thanks to [https://www.nluug.nl/index-en.html NLUUG association] for recording this.
 
* Watch [https://www.youtube.com/watch?v=FXTRRwXi3b4 Getting a grasp of nftables], thanks to [https://www.nluug.nl/index-en.html NLUUG association] for recording this.
 +
* Watch [https://www.youtube.com/watch?v=CaYp0d2wiuU#t=1m47s The ultimate packet classifier for GNU/Linux], thanks to the FSFE for paying my trip to Barcelona and for recommending me as speaker to the KDE Spanish branch.
 
* [https://www.youtube.com/watch?v=Sy0JDX451ns Florian Westphal - Why nftables?]
 
* [https://www.youtube.com/watch?v=Sy0JDX451ns Florian Westphal - Why nftables?]
 
* Watch [https://www.youtube.com/watch?v=qXVOA2MKA1s Netdev 2.1 - Netfilter workshop]
 
* Watch [https://www.youtube.com/watch?v=qXVOA2MKA1s Netdev 2.1 - Netfilter workshop]
 +
* Watch [https://youtu.be/iCj10vEKPrw Netdev 2.2 - Netf‌ilter mini-workshop]
 +
* Watch [https://youtu.be/0hqfzp6tpZo Netdev 0x12 - Netf‌ilter mini-workshop]
 
* Watch [https://www.youtube.com/watch?v=0wQfSfDVN94 NLUUG - Goodbye iptables, Hello nftables]
 
* Watch [https://www.youtube.com/watch?v=0wQfSfDVN94 NLUUG - Goodbye iptables, Hello nftables]
 +
* Watch [https://www.youtube.com/watch?v=Uf5ULkEWPL0 LCA2018 - nftables from a user perspective]
  
 
Additional documentations and articles:
 
Additional documentations and articles:
Line 108: Line 126:
  
 
[https://nlnet.nl https://nlnet.nl/image/logo.gif]
 
[https://nlnet.nl https://nlnet.nl/image/logo.gif]
 +
 +
To Eric Leblond, for boostrapping the [https://home.regit.org/netfilter-en/nftables-quick-howto/ Nftables quick howto] in 2013.

Latest revision as of 13:06, 24 June 2020

Welcome to the nftables HOWTO documentation page. Here you will find documentation on how to build, install, configure and use nftables.

If you have any suggestion to improve it, please send your comments to Netfilter users mailing list <netfilter@vger.kernel.org>.

Introduction

Getting started

Basic operation

Supported selectors for packet matching

Possible actions on packets

Note that, unlike iptables, you can perform several actions in one single rule.

Advanced data structures for performance packet classification

You will have to redesign your rule-set to benefit from these new nice features:

If you are already using ipset in your iptables rule-set, that transition may be a bit more simple to you.

Examples

Development

Check Portal:DeveloperDocs - documentation for netfilter developers.

Some hints on the general development progress:

External links

Watch some videos:

Additional documentations and articles:

Thanks

To the NLnet foundation for initial sponsorship of this HOWTO:

logo.gif

To Eric Leblond, for boostrapping the Nftables quick howto in 2013.