Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| linux_router:nftables [2021-06-30 Wed wk26 20:17] – [Sample NFTables configuration] baumkp | linux_router:nftables [2025-03-02 Sun wk09 15:31] (current) – [NFTables Configuration] baumkp | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| {{tag> | {{tag> | ||
| =====NFTables Configuration===== | =====NFTables Configuration===== | ||
| - | + | The best reference for nftables is at the dedicated wiki [[https:// | |
| - | The best reference for nftables is at the dedicated wiki [[https:// | + | |
| After a lot of experimenting the following is my NFTables router configuration file. Create the following file called: " | After a lot of experimenting the following is my NFTables router configuration file. Create the following file called: " | ||
| + | |||
| + | Dont forget to ensure the router is allowed to forward packets: | ||
| + | * '' | ||
| + | * '' | ||
| + | * '' | ||
| + | Also make permanent in ''/ | ||
| + | ====iptables==== | ||
| + | It is not a good idea to have both iptables and nftables rules setup at the same time. | ||
| + | *To check existing iptables rules: '' | ||
| + | <code text>-P INPUT ACCEPT | ||
| + | -P FORWARD ACCEPT | ||
| + | -P OUTPUT ACCEPT</ | ||
| + | *The iptables rules can be flushed with '' | ||
| + | |||
| ====Sample NFTables configuration==== | ====Sample NFTables configuration==== | ||
| Line 17: | Line 30: | ||
| * Another option would be to use '' | * Another option would be to use '' | ||
| </ | </ | ||
| - | < | + | < |
| < | < | ||
| < | < | ||
| + | < | ||
| < | < | ||
| < | < | ||
| Line 146: | Line 160: | ||
| < | < | ||
| < | < | ||
| - | < | + | < |
| < | < | ||
| < | < | ||
| Line 156: | Line 170: | ||
| < | < | ||
| < | < | ||
| - | < | + | < |
| - | < | + | < |
| - | < | + | < |
| < | < | ||
| - | < | + | < |
| - | < | + | < |
| < | < | ||
| < | < | ||
| Line 241: | Line 255: | ||
| < | < | ||
| < | < | ||
| - | < | + | < |
| < | < | ||
| < | < | ||
| Line 249: | Line 263: | ||
| < | < | ||
| < | < | ||
| - | < | + | < |
| - | < | + | < |
| < | < | ||
| < | < | ||
| < | < | ||
| - | < | + | < |
| - | < | + | < |
| < | < | ||
| < | < | ||
| Line 266: | Line 280: | ||
| ++++ | ++++ | ||
| + | ++++mail server ports:| | ||
| + | * smtp {25} / (smtps) submissions {465} / submission {587} - (My mail server uses smtp / submission on ports 25 / 587 respectivily) | ||
| + | * imap {143} / imaps {993} - (My mail server uses starttls on port 143) | ||
| + | * pop3 {110} / pop3s {995} - who still uses pop3? | ||
| + | '' | ||
| + | ++++ | ||
| ===Some configuration notes=== | ===Some configuration notes=== | ||
| Line 274: | Line 294: | ||
| Some key related commands: | Some key related commands: | ||
| - | *To load a nft configuration file: '' | + | *To load a nft configuration file: '' |
| + | *Another option is to restart the nftables systemd service, '' | ||
| + | *To test the configuration after modification '' | ||
| *The nftables configuration file can be made into an executable script as follows. | *The nftables configuration file can be made into an executable script as follows. | ||
| *Add the following at the top of the file: | *Add the following at the top of the file: | ||
| Line 325: | Line 347: | ||
| This only affects local networks that use NAT which is basically mandatory for IPv4 and not required for IPv6, hence unless NAT is used in a IPv6 local network hairpin. | This only affects local networks that use NAT which is basically mandatory for IPv4 and not required for IPv6, hence unless NAT is used in a IPv6 local network hairpin. | ||
| - | * <fs smaller>Whilst investigating this matter commentary it was often stated that this problem is better solved using DNS. However | + | * Whilst investigating this matter' |
| \\ | \\ | ||
| \\ | \\ | ||
| < | < | ||
| < | < | ||
| - | (Where the gateway (router) is on the network device | + | (Where the gateway (router) is on the network |
| | | ||
| {{: | {{: | ||