User contributions
Jump to navigation
Jump to search
- 19:53, 13 July 2016 diff hist +350 N Bridge filtering Created page with "== Limitation == There is currently no connection tracking available for bridge filtering. == Examples == Filter on TCP destination port: <source lang="bash"> nft add rule..."
- 19:53, 13 July 2016 diff hist +1,166 N Multiple NATs using nftables maps Created page with "Thanks to nftables Maps, if you have a previous iptables NAT (destination NAT) ruleset like this: <source lang="bash"> % iptables -t nat -A PREROUTING -p tcp --dport 1000..."
- 19:52, 13 July 2016 diff hist +1,147 N List of updates since Linux kernel 3.13 Created page with "A listing of the development progress. == 3.13 == * nf_tables merged mainstream. == 3.14 == * set packet mark support. * nfqueue support (only for ip and ip6 families). *..."
- 19:52, 13 July 2016 diff hist +18,428 N Supported features compared to xtables Created page with "Last update: 2016/Jan/11 This page tr..."
- 19:51, 13 July 2016 diff hist +747 N Configuring tables Created page with "You can also delete tables with the following command: <source lang="bash"> % nft delete table ip foo </source> '''Troubleshooting''': Since Linux kernel 3.18, you can delet..."
- 19:51, 13 July 2016 diff hist +7,032 N Configuring chains Created page with "As in ''iptables'', you attach your rules to chains. However, contrary to the ''iptables'' modus operandi, the ''nftables'' infrastructure comes with no pr..."
- 19:50, 13 July 2016 diff hist +6,657 N Simple rule management Created page with "= Appending new rules = To add new rules, you have to specify the corresponding table and the chain that you want to use, eg. <source lang="bash"> % nft add rule filter outp..."
- 19:50, 13 July 2016 diff hist +1,077 N Atomic rule replacement Created page with "You can use the ''-f'' option to atomically update your rule-set: <source lang="bash"> % nft -f file </source> Where ''file'' contains your rule-set. You can save your rule..."
- 19:49, 13 July 2016 diff hist +713 N Error reporting from the command line Created page with "The ''nft'' command line utility tries to help you when you use a wrong datatype. The following examples shows the error output if you pass an IPv4 address as a TCP port. <s..." current
- 19:49, 13 July 2016 diff hist +970 N Building rules through expressions Created page with "''nftables'' provides the following built-in operations: * '''ne''' which stands for non equal. Alternatively you can use '''!='''. * '''lt''' means ''less than''. Alternativ..."
- 19:48, 13 July 2016 diff hist +1,531 N Operations at ruleset level Created page with "== Using native nft syntax == Linux Kernel 3.18 includes some improvements regarding the available operations to manage your ruleset as a whole. === listing === Listing the..."
- 19:48, 13 July 2016 diff hist +1,307 N Monitoring ruleset updates Created page with "nft can display notifications of ruleset updates through: <source lang="bash"> % nft monitor </source> This subscribes ''nft'' to any kind of ruleset update. You can filte..." current
- 19:48, 13 July 2016 diff hist +2,452 N Scripting Created page with "Many people like to maintain their ruleset in shell scripts, this allows them to add comments and arrange rules in more human-friendly way. This is problematic though since sh..."
- 19:47, 13 July 2016 diff hist +3,479 N Ruleset debug/tracing Created page with "Since nftables v0.6 and linux kernel 4.6, ruleset debug/tracing is supported. This is an equivalent of the old iptables method -J TRACE, but with some great improvements. Th..."
- 19:47, 13 July 2016 diff hist +2,992 N Matching packet headers Created page with "The ''nft'' command line utility supports the following layer 4 protocols: AH, ESP, UDP, UDPlite, TCP, DCCP, SCTP and IPComp. = Matching transport protocol = The following r..."
- 19:46, 13 July 2016 diff hist +2,504 N Matching packet metainformation Created page with "''nftables'' comes with the packet metainformation selectors that you can use to match information that is stored in the network packet. = The meta selectors = The current..."
- 19:46, 13 July 2016 diff hist +1,601 N Matching connection tracking stateful metainformation Created page with "As in ''iptables'', you can match the state tracking information (sometimes refered as ''conntrack'' or ''ct'' information) that Netfilter collects through the ''Connection Tr..."
- 19:45, 13 July 2016 diff hist +818 N Accepting and dropping packets Created page with "= Dropping packets = You can use the ''drop'' option to drop packets. Note that drop is a '''terminating''' action, so you cannot add any other action after it. <source lang..." current
- 19:44, 13 July 2016 diff hist +1,118 N Rate limiting matchings Created page with "You can ratelimit traffic through ''limit''. The following example shows how to accept a maximum of 10 ICMP echo-request packets per second: <source lang="bash"> % nft add r..."
- 19:38, 13 July 2016 diff hist +3,631 N Main differences with iptables Created page with "The main differences between ''nftables'' and ''iptables'' from the user point of view are: * The '''syntax'''. The ''iptables'' command line tool uses a getopt_long()-based..."