nft

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

Wat het doet

nftables replaced iptables. firewalld writes its rules into nftables (table inet firewalld). With nft list ruleset you see what the kernel really does. On systems with firewalld, use firewall-cmd for changes; write nft rules yourself only on systems without firewalld (then use nftables.service and /etc/sysconfig/nftables.conf).

Zo schrijf je het

nft [OPTION]... COMMAND
nft -f FILE

Belangrijkste delen

list ruleset: Show all rules.
list tables / list table FAMILY NAME: Tables.
list chain FAMILY TABLE CHAIN: One chain.
add table, add chain, add rule: Create.
insert rule, replace rule, delete rule handle N: Change rules.
add set, add element: Address or port sets.
flush ruleset: Remove all rules (dangerous).
monitor: Watch rule changes and traces.
FAMILY: ip, ip6, inet (both), arp, bridge, netdev.

Opties 18

Meest gebruikt

-a, --handle: Show rule handles (needed to delete a rule).
-f, --file FILE: Read commands from a file.
-c, --check: Check the commands, do not apply.
-n, --numeric: Numbers instead of names (addresses, ports).
-N, --reversedns: Resolve IPs to names.
-S, --service: Port numbers as service names.
-s, --stateless: Leave out counters and state.
-t, --terse: Leave out set contents.
-j, --json: JSON output.
-e, --echo: Print what was added.
-i, --interactive: Interactive mode.
-D, --define NAME=VALUE: Define a variable for files.
-I, --includepath DIR: Folder for include files.
-o, --optimize: Optimize the rules.
-y, --numeric-priority, -p, --numeric-protocol, -T, --numeric-time, -u, --guid: More numeric output.
-d, --debug LEVEL: Debug output.
-h, --help: Show help.
-v, --version: Show the version.

Voorbeelden 10

$ als gewone gebruiker# als root (of met sudo)

1All rules
```
#nft list ruleset | less
```
Includes the rules firewalld made.
2Tables
```
#nft list tables
table inet firewalld
```
firewalld's table.
3firewalld zone rules
```
#nft list chain inet firewalld filter_IN_public_allow
```
The services of the public zone as rules.
4Rules with handles
```
#nft -a list ruleset | grep handle | head
```
Handles identify single rules.
5Check a rules file
```
#nft -c -f /etc/sysconfig/nftables.conf
```
Syntax check before loading.

6A simple firewall without firewalld

#nft add table inet filter
#nft add chain inet filter input '{ type filter hook input priority 0; policy drop; }'
#nft add rule inet filter input ct state established,related accept
#nft add rule inet filter input iif lo accept
#nft add rule inet filter input tcp dport 22 accept

Only on systems where firewalld is off.

7Block a list of attackers with a set

#nft add set inet filter blocklist '{ type ipv4_addr; }'
#nft add element inet filter blocklist '{ 203.0.113.50 }'
#nft add rule inet filter input ip saddr @blocklist drop

Sets scale to many addresses.

8Save the current rules
```
#nft list ruleset > /etc/sysconfig/nftables.conf
```
Loaded by nftables.service at boot.
9Watch rule changes
```
#nft monitor
```
Shows changes live (for example from firewall-cmd).

10JSON for tools

#nft -j list ruleset | jq '.nftables | length'

Machine-readable.

Let op

Do not change firewalld's tables by hand; a reload overwrites them.
flush ruleset with a drop policy can cut your SSH session.

Bestanden

/etc/sysconfig/nftables.conf: Rules for nftables.service.
/etc/nftables/: Example rule files.

Exitcodes

`0`	Done.
`1`	Error.

`nft`

Wat het doet

Zo schrijf je het

Belangrijkste delen

Opties 18

Voorbeelden 10

1All rules

2Tables

3firewalld zone rules

4Rules with handles

5Check a rules file

6A simple firewall without firewalld

7Block a list of attackers with a set

8Save the current rules

9Watch rule changes

10JSON for tools

Let op

Bestanden

Exitcodes

Volledige handleiding

Wat het doet

Zo schrijf je het

Belangrijkste delen

Opties 18

Voorbeelden 10

1All rules

2Tables

3firewalld zone rules

4Rules with handles

5Check a rules file

6A simple firewall without firewalld

7Block a list of attackers with a set

8Save the current rules

9Watch rule changes

10JSON for tools

Let op

Bestanden

Exitcodes

Verwante commando's

Gebruikt in deze lessen

Volledige handleiding

`nft`