User contributions
Jump to navigation
Jump to search
- 19:58, 13 July 2016 diff hist +3,726 N Performing Network Address Translation (NAT) Created page with "The ''nat'' chain type allows you to perform NAT. This chain type comes with special semantics: * The first packet of a flow is used to look up for a matching rule which sets..."
- 19:58, 13 July 2016 diff hist +1,702 N Setting packet metainformation Created page with "You can set some metainformation in a packet: one of mark, priority or nftrace. Please note that you require a Linux kernel >= 3.14 to use these features. == mark == The fol..."
- 19:57, 13 July 2016 diff hist +2,799 N Queueing to userspace Created page with "= Basic operation = '''Important note''': You require a Linux kernel 3.14 to enqueue packets to userspace using nftables. Like in ''iptables'', you can use the nfqueue infra..." current
- 19:57, 13 July 2016 diff hist +1,024 N Duplicating packets Created page with "Since Linux kernel 4.3, you can duplicate packets to another destination from the ''ip'' and ''ip6'' families. You may want to use this feature to address this traffic to anot..."
- 19:57, 13 July 2016 diff hist +644 N Counters Created page with "Counters are optional in ''nftables'', thus, you need to explicitly specify them in the rule if you want them. The following example allows you to account all tcp traffic tha..."
- 19:56, 13 July 2016 diff hist +2,893 N Sets Created page with "''nftables'' comes with a built-in generic set infrastructure that allows you to use '''any''' supported selector to build sets. This infrastructure makes possible the represe..."
- 19:56, 13 July 2016 diff hist +2,632 N Verdict Maps (vmaps) Created page with "The ''dictionaries'', also known as ''verdict maps'', are one of the most interesting features available in ''nftables''. Basically, they allow you to attach an action to an e..."
- 19:56, 13 July 2016 diff hist +865 N Intervals Created page with "Intervals are expressed as value-value. The following example show how to drop the traffic coming the range 192.168.0.1 to 192.168.0.250: <source lang="bash"> % nft add rule..."
- 19:55, 13 July 2016 diff hist +1,564 N Maps Created page with "Maps are yet another interesting feature that has been in ''nftables'' since the very beginning. You can use a map to look up for data based on some specific key that is used..."
- 19:54, 13 July 2016 diff hist +1,727 N Concatenations Created page with "Since Linux kernel 4.1, nftables supports concatenations. This new feature allows you to put two or more selectors together to perform very fast lookups by combining them wit..."
- 19:54, 13 July 2016 diff hist +1,845 N Simple ruleset for a workstation Created page with "= fw.basic = <source lang="bash"> table ip filter { chain input { type filter hook input priority 0; # accept traffic originated from us c..."
- 19:53, 13 July 2016 diff hist +350 N Bridge filtering Created page with "== Limitation == There is currently no connection tracking available for bridge filtering. == Examples == Filter on TCP destination port: <source lang="bash"> nft add rule..."
- 19:53, 13 July 2016 diff hist +1,166 N Multiple NATs using nftables maps Created page with "Thanks to nftables Maps, if you have a previous iptables NAT (destination NAT) ruleset like this: <source lang="bash"> % iptables -t nat -A PREROUTING -p tcp --dport 1000..."
- 19:52, 13 July 2016 diff hist +1,147 N List of updates since Linux kernel 3.13 Created page with "A listing of the development progress. == 3.13 == * nf_tables merged mainstream. == 3.14 == * set packet mark support. * nfqueue support (only for ip and ip6 families). *..."
- 19:52, 13 July 2016 diff hist +18,428 N Supported features compared to xtables Created page with "Last update: 2016/Jan/11 This page tr..."
- 19:51, 13 July 2016 diff hist +747 N Configuring tables Created page with "You can also delete tables with the following command: <source lang="bash"> % nft delete table ip foo </source> '''Troubleshooting''': Since Linux kernel 3.18, you can delet..."
- 19:51, 13 July 2016 diff hist +7,032 N Configuring chains Created page with "As in ''iptables'', you attach your rules to chains. However, contrary to the ''iptables'' modus operandi, the ''nftables'' infrastructure comes with no pr..."
- 19:50, 13 July 2016 diff hist +6,657 N Simple rule management Created page with "= Appending new rules = To add new rules, you have to specify the corresponding table and the chain that you want to use, eg. <source lang="bash"> % nft add rule filter outp..."
- 19:50, 13 July 2016 diff hist +1,077 N Atomic rule replacement Created page with "You can use the ''-f'' option to atomically update your rule-set: <source lang="bash"> % nft -f file </source> Where ''file'' contains your rule-set. You can save your rule..."
- 19:49, 13 July 2016 diff hist +713 N Error reporting from the command line Created page with "The ''nft'' command line utility tries to help you when you use a wrong datatype. The following examples shows the error output if you pass an IPv4 address as a TCP port. <s..." current