- Page: 1.3 » Linux Magazine

A simpler packet filter

Save and Restore

Similar to iptables, the nftables configuration can be saved to a file. Line 1 in Listing 4 writes the current ruleset to the firewall.config file, and line 2 reads the configuration back in.

Listing 4

Saving nftables Configuration

01 # nft list ruleset > firewall.config
02 # nft -f firewall.config

To make sure that there are no other (possibly interfering) rules left in the cache before initializing the firewall, you should add the line flush ruleset at the beginning of the configuration file firewall.config.

Creatures of habit, humans have a hard time with change. To help out with the transition from iptables to nft, the iptables-translate and ip6tables-translate commands convert the spelling of iptables firewall rules to those of nftables (Listing 5). This works for both individual instructions and complete rulesets.

Listing 5

Converting Rules

$ iptables-translate -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
nft add rule ip filter INPUT tcp dport 22 ct state new counter accept
$ ip6tables-translate -A FORWARD -i eth0 -o eth3 -p udp -m multiport --dports 111,222 -j ACCEPT
nft add rule ip6 filter FORWARD iifname eth0 oifname eth3 meta l4proto udp udp dport { 111,222} counter accept

Conclusions

Nftables helps to group several complex tools under a common umbrella, making it easier to secure the network. To thoroughly test the new firewall ruleset, you can, for example, use a bunch of Raspberry Pis on a small, dedicated network. Alternatively, you can create a virtual test network using VirtualBox or the smart Mininet [16] application.

Acknowledgements

The author would like to thank Axel Beckert and Werner Heuser for feedback during the preparation of this article.

Infos

LPIC-2: https://www.lpi.org/our-certifications/lpic-2-overview
netfilter project: https://netfilter.org
IPFilter: https://en.wikipedia.org/wiki/IPFilter
nftables: https://netfilter.org/projects/nftables
"What comes after iptables?": https://developers.redhat.com/blog/2016/10/28/what-comes-after-iptables-its-successor-of-course-nftables
"Why you will love nftables": https://home.regit.org/2014/01/why-you-will-love-nftables
Debian relies on nftables: https://wiki.debian.org/nftables
"Hello nftables, Goodbye iptables": https://linuxnewbieguide.org/hello-nftables-goodbye-iptables
libmnl: https://git.netfilter.org/libmnl
libnftnl: https://git.netfilter.org/libnfnetlink
"IPtables vs. nftables": https://digitalglarus.ch/en-us/cms/blog/2018/08/19/iptables-vs-nftables
BPF: https://en.wikipedia.org/wiki/Berkeley_Packet_Filter
tcpdump: https://www.tcpdump.org
"Differences between iptables and nftables explained": https://linux-audit.com/differences-between-iptables-and-nftables-explained/
ISO/OSI specification: https://en.wikipedia.org/wiki/OSI_model
Mininet: http://mininet.org

The Author

Frank Hofmann works on the road, preferably in Berlin, Geneva, and Cape Town, as a developer, LPI-certified trainer, and author. He is the coauthor of the Debian package management book (http://www.dpmb.org/index.en.html).

« Previous 1 2