A simpler packet filter

Save and Restore

Similar to iptables, the nftables configuration can be saved to a file. Line 1 in Listing 4 writes the current ruleset to the firewall.config file, and line 2 reads the configuration back in.

Listing 4

Saving nftables Configuration

01 # nft list ruleset > firewall.config
02 # nft -f firewall.config

To make sure that there are no other (possibly interfering) rules left in the cache before initializing the firewall, you should add the line flush ruleset at the beginning of the configuration file firewall.config.

Creatures of habit, humans have a hard time with change. To help out with the transition from iptables to nft, the iptables-translate and ip6tables-translate commands convert the spelling of iptables firewall rules to those of nftables (Listing 5). This works for both individual instructions and complete rulesets.

Listing 5

Converting Rules

$ iptables-translate -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
nft add rule ip filter INPUT tcp dport 22 ct state new counter accept
$ ip6tables-translate -A FORWARD -i eth0 -o eth3 -p udp -m multiport --dports 111,222 -j ACCEPT
nft add rule ip6 filter FORWARD iifname eth0 oifname eth3 meta l4proto udp udp dport { 111,222} counter accept

Conclusions

Nftables helps to group several complex tools under a common umbrella, making it easier to secure the network. To thoroughly test the new firewall ruleset, you can, for example, use a bunch of Raspberry Pis on a small, dedicated network. Alternatively, you can create a virtual test network using VirtualBox or the smart Mininet [16] application.

Acknowledgements

The author would like to thank Axel Beckert and Werner Heuser for feedback during the preparation of this article.

Infos

  1. LPIC-2: https://www.lpi.org/our-certifications/lpic-2-overview
  2. netfilter project: https://netfilter.org
  3. IPFilter: https://en.wikipedia.org/wiki/IPFilter
  4. nftables: https://netfilter.org/projects/nftables
  5. "What comes after iptables?": https://developers.redhat.com/blog/2016/10/28/what-comes-after-iptables-its-successor-of-course-nftables
  6. "Why you will love nftables": https://home.regit.org/2014/01/why-you-will-love-nftables
  7. Debian relies on nftables: https://wiki.debian.org/nftables
  8. "Hello nftables, Goodbye iptables": https://linuxnewbieguide.org/hello-nftables-goodbye-iptables
  9. libmnl: https://git.netfilter.org/libmnl
  10. libnftnl: https://git.netfilter.org/libnfnetlink
  11. "IPtables vs. nftables": https://digitalglarus.ch/en-us/cms/blog/2018/08/19/iptables-vs-nftables
  12. BPF: https://en.wikipedia.org/wiki/Berkeley_Packet_Filter
  13. tcpdump: https://www.tcpdump.org
  14. "Differences between iptables and nftables explained": https://linux-audit.com/differences-between-iptables-and-nftables-explained/
  15. ISO/OSI specification: https://en.wikipedia.org/wiki/OSI_model
  16. Mininet: http://mininet.org

The Author

Frank Hofmann works on the road, preferably in Berlin, Geneva, and Cape Town, as a developer, LPI-certified trainer, and author. He is the coauthor of the Debian package management book (http://www.dpmb.org/index.en.html).

« Previous 1 2

Buy this article as PDF

Express-Checkout as PDF
Price $2.95
(incl. VAT)

Buy Linux Magazine

SINGLE ISSUES
Print Issues
Digital Issues
 
SUBSCRIPTIONS
Print Subs
Digisubs
 
TABLET & SMARTPHONE APPS
Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

Related content

  • Nftables

    The nftables firewall utility offers a simpler and more consistent approach for managing firewalls in Linux.

    more »
  • New Kernel Firewall Nftables to Succeed Netfilter

    The Netfilter team has long been mulling over rework of firewall code in the Linux kernel. Now team lead Patrick McHardy ends months of work by announcing nftables.

    more »
  • FAQ

    Nftables promises to be the future of Linux firewalls. Meet iptables' replacement.

    more »
  • Persistent iptables

    The Linux iptables packet filter lacks an easy way to load rules automatically after restarting a system, but you can automate this process several ways.

    more »
  • Netfilter's Recent Module

    Netfilter’s Recent module builds a temporary blacklist to keep intruders off your network.

    more »
comments powered by Disqus
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters

Support Our Work

Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.

Learn More

News

Tag Cloud

Administration Community Events Hardware Linux Linux Pro Magazine Mobile Programming Security Software Ubuntu Web Development Windows free software open source