Difference between revisions of "Nftables families"
(→bridge: reword sentence aboyt physdev)
|Line 51:||Line 51:|
== netdev ==
== netdev ==
Tables of this family will see
Tables of this family will see packets the . .
Note that is
to given . the .
Revision as of 02:48, 12 December 2017
nftables families are a new concept introduced with this technology which was previously missing in the iptables world. You may already know that the nftables framework is designed to work with all typical address families (IPv4, IPv6, ARP). In the past, all the families were handled by different tools: iptables, ip6tables, arptables, ebtables.
Please note that what traffic/packets you see and at which point in the network stack depends on the chain hook you are using. You can create tables/chains/sets/rules in any family with the nft command line interface, out of the box, no need for different tools. Additional families may be added in the future for extended nftables functionalities.
Tables of this family will see IPv4 traffic/packets. The iptables tool was the equivalent in the old x_tables world.
Tables of this family will see IPv6 traffic/packets. The ip6tables tool was the equivalent in the old x_tables world.
Tables of this family will see both IPv4/IPv6 traffic/packets, designed to improve dual stack support. Mixing iptables and ip6tables rules in the same box was the equivalent in the old x_tables world.
Both IPv4/IPv6 packets will traverse the same rules. Rules for IPv4 packets won't affect IPv6 packets. Rules for both L3 protocol will affect both.
# this rule only affects IPv4 packets add rule inet filter input ip saddr 126.96.36.199 counter accept # this rule only affects IPv6 packets add rule inet filter input ip6 daddr fe00::2 counter accept # these rules affects both IPv4/IPv6 packets add rule inet filter input ct state established,related counter accept add rule inet filter input udp dport 53 accept
Tables of this family will see ARP-level (i.e, L2) traffic, before any L3 handling is done by the kernel. The arptables tool was the equivalent in the old x_tables world.
Tables of this family will see traffic/packets traversing bridges (i.e. switching). No assumptions are made about L3 protocols. The ebtables tool was the equivalent in the old x_tables world. Also, some old x_tables modules such as physdev will eventually be served natively from this family.
Note that there is no nf_conntrack integration for this family. However this may change in the future.
Tables of this family will see packets that driver has just passed up to the networking stack, this means you see all traffic getting in into devices. Therefore, you can filter ARP traffic from here too.
Note that there is no equivalent in the old iptables world, this is a new feature available since 4.2 for nftables.
This family provides the ingress hook. This location is ideal to drop packets that result from DDOS attacks given this is very early in the packet path. Dropping packets from here is much more efficient than from the classic prerouting chain, by a factor of 2x.