nftables - the evolution of Linux Firewall
Download as ODP, PDF4 likes5,481 views
This document provides an overview of nftables, the new packet filtering framework that replaces iptables in the Linux kernel. It discusses the history and predecessors to nftables, how nftables works, key differences from iptables like its more flexible table and chain configuration, and examples of basic nftables rulesets. It also covers topics like matches, jumps, load balancing performance, and kernel configuration options for nftables.
![nftables vs. iptablesnftables vs. iptables
➢ Tables and chains are fully configurable
list
tables [family]
table [family] <name>
chain [family] <table> <name>
add
table [family] <name>
chain [family] <table> <name> [chain definitions]
rule [family] <table> <chain> <rule definition>
table [family] <name> (shortcut for `add table`)
Families:
ip - IPv4
ip6 - IPv6
inet - IPv4 or v6
arp - arp
bridge - linux bridge](https://image.slidesharecdn.com/nftables-170114202255/85/nftables-the-evolution-of-Linux-Firewall-10-320.jpg)
![Kernel configurationKernel configuration
[*] Networking support --->
Networking options --->
[*] Network packet filtering framework (Netfilter) --->
Core Netfilter Configuration --->
<M> Netfilter nf_tables support
<M> Netfilter nf_tables conntrack module
<M> Netfilter nf_tables counter module
<M> Netfilter nf_tables log module
<M> Netfilter nf_tables limit module
<M> Netfilter nf_tables masquerade support
<M> Netfilter nf_tables nat module
IP: Netfilter Configuration --->
<M> IPv4 nf_tables support
<M> IPv4 nf_tables route chain support
<M> IPv4 packet rejection
<M> IPv4 NAT
<M> IPv4 nf_tables nat chain support
<M> IPv4 masquerade support
<M> IPv4 masquerading support for nf_tables](https://image.slidesharecdn.com/nftables-170114202255/85/nftables-the-evolution-of-Linux-Firewall-28-320.jpg)
nftables - the evolution of Linux Firewall
- 1. NF TABLESNF TABLES Marian HackMan Marinov Chief System Architect of SiteGround.com <mm@1h.com>
- 2. Who am I?Who am I?
- 3. HistoryHistory ➢ ipfw ➢ ipchains ➢ iptables ➢ arptables ➢ ebtables ➢ nftables
- 4. nftablesnftables ➢ Replacement of iptables, ip6tables, arptables & ebtables ➢ including ipset ➢ Remove the duplicated code from all modules ➢ Simplify the dual stack(IPv4/6) handling ➢ ip, ip6, inet, arp & bridge address families
- 5. nftablesnftables ➢ Merged mainstream in October 2013, available since January 2014 in Linux kernel 3.13. ➢ It reuses the existing Netfilter building blocks: hooks, conntrack, NAT, logging and userspace queueing. ➢ It also reuses existing xtables extensions through nft compat.
- 8. nftables flownftables flow Routing Decision Routing Decision Local Process prerouting input output forward postrouting NETWORK NETWORK
- 9. Routing Decision Routing Decision Local Process prerouting input output forward postrouting NETWORK NETWORKRouting Decision ingress nftables flownftables flow with ingress filterwith ingress filter
- 10. nftables vs. iptablesnftables vs. iptables ➢ Tables and chains are fully configurable list tables [family] table [family] <name> chain [family] <table> <name> add table [family] <name> chain [family] <table> <name> [chain definitions] rule [family] <table> <chain> <rule definition> table [family] <name> (shortcut for `add table`) Families: ip - IPv4 ip6 - IPv6 inet - IPv4 or v6 arp - arp bridge - linux bridge
- 11. nftables vs. iptablesnftables vs. iptables ➢ Tables and chains are fully configurable ➢ Tables are without any predefined purpose ➢ there are no raw, filter, nat & mangle tables
- 12. nftables vs. iptablesnftables vs. iptables ➢ Tables and chains are fully configurable ➢ Tables are without any predefined purpose ➢ there are no raw, filter, nat & mangle tables ➢ By default there are no chains ➢ if there is no chain that would match the packet it will not be touched by netfilter code ➢ Every chain has a type: ➢ filter ➢ nat (only the first packet of a flow hits this chain) ➢ route (mangle)
- 13. HooksHooks ➢ Base chains are the ones that are attached to hooks ➢ Non-base chains are used for ordering ➢ All available hooks: ➢ ingress ➢ input ➢ output ➢ forward ➢ prerouting ➢ postrouting
- 14. nftables vs. iptablesnftables vs. iptables ➢ No distinction between matches and targets anymore ➢ no difference between ACCEPT and -s # nft insert rule filter input ct state established accept VS. # iptables -I INPUT -j ACCEPT -m conntrack --ctstate ESTABLISHED
- 15. nftables vs. iptablesnftables vs. iptables ➢ You can specify several actions in one single rule # nft add rule filter forward tcp dport 22 log drop VS. # iptables -A FORWARD -p tcp --dport 22 -j LOG # iptables -A FORWARD -p tcp --dport 22 -j DROP
- 16. nftables vs. iptablesnftables vs. iptables ➢ No built-in counter per chain and rules ➢ counters introduce delays in packet processing ➢ counters can be added to any chain using the 'counter' keyword # nft add rule ip filter output ip daddr 1.2.3.4 counter drop
- 17. nftables vs. iptablesnftables vs. iptables ➢ New supported protocols without kernel upgrades ➢ most of the logic in nftables is inside its userspace ➢ it compiles the rules to VM bytecode in netlink format and then it pushes this into the kernel via the nftables Netlink API ➢ it provides generic set and map infrastructure
- 18. nftables vs. iptablesnftables vs. iptables ➢ Better support for dynamic ruleset updates ➢ iptables always replaces all rules ➢ even if you only delete one rule ➢ even if you only add one rule ➢ nftables uses linked-list to solve this issue
- 19. flush rulesetflush ruleset table inet filter {table inet filter { chain input {chain input { type filter hook input priority 0; policy drop;type filter hook input priority 0; policy drop; # established/related connections# established/related connections ct state established,related acceptct state established,related accept # invalid connections# invalid connections ct state invalid dropct state invalid drop # loopback interface# loopback interface iif lo acceptiif lo accept
- 20. # ICMP# ICMP # routers may also want: mld-listener-query, nd-router-solicit# routers may also want: mld-listener-query, nd-router-solicit ip6 nexthdr icmpv6 icmpv6 type { destination-unreachable, packet-too-big,ip6 nexthdr icmpv6 icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, nd-router-advert, nd-neighbor-solicit, nd-time-exceeded, parameter-problem, nd-router-advert, nd-neighbor-solicit, nd- neighbor-advert } acceptneighbor-advert } accept ip protocol icmp icmp type { destination-unreachable, router-advertisement,ip protocol icmp icmp type { destination-unreachable, router-advertisement, time-exceeded, parameter-problem } accepttime-exceeded, parameter-problem } accept # SSH (port 22)# SSH (port 22) tcp dport ssh accepttcp dport ssh accept # HTTP (ports 80 & 445)# HTTP (ports 80 & 445) tcp dport { http, https } accepttcp dport { http, https } accept }} }}
- 21. ➢ Basic Jump example:Basic Jump example: table inet filter {table inet filter { chain web {chain web { tcp dport http accepttcp dport http accept tcp dport 8080 accepttcp dport 8080 accept }} chain input {chain input { type filter hook input priority 0;type filter hook input priority 0; ip saddr 10.0.2.0/24 jump webip saddr 10.0.2.0/24 jump web dropdrop }} }}
- 22. InterestingInteresting ➢ Concatenated Value Pairs # nft add element traffic-filter dict { 192.168.0.1 : drop, 192.168.0.2 : accept } ➢ Easy Data Export # nft export json ➢ Multiple Actions # nft add rule ip filter input ip protocol vmap { tcp : jump tcp-chain, udp : jump udp-chain, icmp : jump icmp-chain }
- 23. JumpsJumps ➢accept (accept a packet) ➢reject (reject a packet) ➢drop (drop a packet) ➢snat (perform source NAT on a packet) ➢dnat (perform destination NAT on a packet) ➢log (log a packet) ➢counter (keep a counter on a packet; counters are optional in nftables) ➢return (stop traversing the chain) ➢jump <chain> (jump to another chain) ➢goto <chain> (jump to another chain, but do not return)
- 24. Match argumentsMatch arguments meta: oif <output interface INDEX> iif <input interface INDEX> oifname <output interface NAME> iifname <input interface NAME> (oif and iif accept string arguments and are converted to interface indexes) (oifname and iifname are more dynamic, but slower because of string matching)
- 25. Match argumentsMatch arguments icmp: type <icmp type> icmpv6: type <icmpv6 type> ip: protocol <protocol> daddr <destination address> saddr <source address> ip6: daddr <destination address> saddr <source address>
- 26. Match argumentsMatch arguments tcp: dport <destination port> sport <source port> udp: dport <destination port> sport <source port> ct: state <new | established | related | invalid>
- 27. Load BalancingLoad Balancing IPv4 performanceIPv4 performance method req/sec %cpu LVS-SNAT 313427.91 24.11 NFT-SNAT 289035.54 23.2 NFT-DNAT 303356.59 23.12 LVS-DSR 356212.05 4.78 NFT-DSR 393672.35 0.54 DSR - Direct Server Return SLB - Server Load Balancing(SNAT/DNAT)
- 28. Kernel configurationKernel configuration [*] Networking support ---> Networking options ---> [*] Network packet filtering framework (Netfilter) ---> Core Netfilter Configuration ---> <M> Netfilter nf_tables support <M> Netfilter nf_tables conntrack module <M> Netfilter nf_tables counter module <M> Netfilter nf_tables log module <M> Netfilter nf_tables limit module <M> Netfilter nf_tables masquerade support <M> Netfilter nf_tables nat module IP: Netfilter Configuration ---> <M> IPv4 nf_tables support <M> IPv4 nf_tables route chain support <M> IPv4 packet rejection <M> IPv4 NAT <M> IPv4 nf_tables nat chain support <M> IPv4 masquerade support <M> IPv4 masquerading support for nf_tables
- 30. Marian HackMan Marinov <mm@1h.com> hackman @ irc.freenode.net https://github.com/hackman