Configuring chains - Revision history

Plushkava: Remove a superfluous newline

2024-10-08T22:35:39Z

Remove a superfluous newline

← Older revision		Revision as of 22:35, 8 October 2024
Line 6:		Line 6:

	Throughout this article, examples that begin with the hash character (U+23) can be taken as examples of valid shell code. That is, they are syntactically valid if entered into any implementation of the Shell Command Language, including bash. By contrast, examples that do not begin with the hash character can be interpreted as either synopses of ''nftables'' grammar, similar in style to the nft(8) man page, or as examples of complete rulesets, if so indicated.		Throughout this article, examples that begin with the hash character (U+23) can be taken as examples of valid shell code. That is, they are syntactically valid if entered into any implementation of the Shell Command Language, including bash. By contrast, examples that do not begin with the hash character can be interpreted as either synopses of ''nftables'' grammar, similar in style to the nft(8) man page, or as examples of complete rulesets, if so indicated.


	As such, examples of shell code shall generally be of the following form.		As such, examples of shell code shall generally be of the following form.

Plushkava: Have the syntactic conventions account for the presence of ruleset samples

2024-10-08T22:31:45Z

Have the syntactic conventions account for the presence of ruleset samples

← Older revision		Revision as of 22:31, 8 October 2024
Line 5:		Line 5:
	Naturally, in order to make use of ''nftables'' commands and directives, it is necessary to become familiar with them, along with their supported grammar. Even with that knowledge, users sometimes experience difficulties where passing ''nftables'' commands as arguments to the nft(8) utility. That's because shells recognise certain characters as metacharacters and treat them in a special way unless they are quoted.		Naturally, in order to make use of ''nftables'' commands and directives, it is necessary to become familiar with them, along with their supported grammar. Even with that knowledge, users sometimes experience difficulties where passing ''nftables'' commands as arguments to the nft(8) utility. That's because shells recognise certain characters as metacharacters and treat them in a special way unless they are quoted.

	Throughout this article, examples that begin with the hash character (U+23) can be taken as examples of valid shell code. That is, they are syntactically valid if entered into any implementation of the Shell Command Language, including bash. By contrast, examples that do not begin with the hash character can be interpreted as synopses of ''nftables'' grammar, similar in style to the nft(8) man page.		Throughout this article, examples that begin with the hash character (U+23) can be taken as examples of valid shell code. That is, they are syntactically valid if entered into any implementation of the Shell Command Language, including bash. By contrast, examples that do not begin with the hash character can be interpreted as either synopses of ''nftables'' grammar, similar in style to the nft(8) man page, or as examples of complete rulesets, if so indicated.


	As such, examples of shell code shall generally be of the following form.		As such, examples of shell code shall generally be of the following form.

Plushkava: Show the example ruleset at the end in the "list ruleset" style as well as a series of incremental commands

2024-10-08T22:24:43Z

Show the example ruleset at the end in the "list ruleset" style as well as a series of incremental commands

← Older revision		Revision as of 22:24, 8 October 2024
Line 181:		Line 181:

	Now, you can start attaching [[Simple rule management\|rules]] to these two base chains. Note that you don't need the ''forward'' chain in this case since this example assumes that you're configuring nftables to filter traffic for a standalone computer that doesn't behave as router.		Now, you can start attaching [[Simple rule management\|rules]] to these two base chains. Note that you don't need the ''forward'' chain in this case since this example assumes that you're configuring nftables to filter traffic for a standalone computer that doesn't behave as router.

			Here is the exact same policy, only shown in the declarative style. That is, in the same format as would be employed upon issuing the "list ruleset" command. Despite the marked difference in style, it constitutes valid ''nftables'' syntax and is equivalent to the combination of "add table" and "add chain" commands shown above.

			<source>
			table ip filter {
			chain input {
			type filter hook input priority filter; policy accept;
			}

			chain output {
			type filter hook output priority filter; policy accept;
			}
			}
			</source>

Plushkava: Replace a stray instance of "foo"

2024-10-08T22:10:31Z

Replace a stray instance of "foo"

← Older revision		Revision as of 22:10, 8 October 2024
Line 31:		Line 31:
	</source>		</source>

	The following example shows how to add a new base chain ''input'' to the ''~~foo~~'' table (which must have been previously created):		The following example shows how to add a new base chain ''input'' to the ''filter'' table (which must have been previously created):

	<source>		<source>

Plushkava: Describe the conventions for examples of nftables grammar

2024-10-08T22:08:57Z

Describe the conventions for examples of nftables grammar

← Older revision		Revision as of 22:08, 8 October 2024
Line 5:		Line 5:
	Naturally, in order to make use of ''nftables'' commands and directives, it is necessary to become familiar with them, along with their supported grammar. Even with that knowledge, users sometimes experience difficulties where passing ''nftables'' commands as arguments to the nft(8) utility. That's because shells recognise certain characters as metacharacters and treat them in a special way unless they are quoted.		Naturally, in order to make use of ''nftables'' commands and directives, it is necessary to become familiar with them, along with their supported grammar. Even with that knowledge, users sometimes experience difficulties where passing ''nftables'' commands as arguments to the nft(8) utility. That's because shells recognise certain characters as metacharacters and treat them in a special way unless they are quoted.

	Throughout this article, examples that begin with the hash character (#) can be taken as examples of valid shell code. That is, they are syntactically valid if entered into any implementation of the Shell Command Language, including bash. By contrast, examples that do not begin with the hash character can be interpreted as synopses of ''nftables'' grammar, similar in style to the nft(8) man page.		Throughout this article, examples that begin with the hash character (U+23) can be taken as examples of valid shell code. That is, they are syntactically valid if entered into any implementation of the Shell Command Language, including bash. By contrast, examples that do not begin with the hash character can be interpreted as synopses of ''nftables'' grammar, similar in style to the nft(8) man page.

	As such, examples of shell code shall generally be of the following form.		As such, examples of shell code shall generally be of the following form.
Line 20:		Line 20:

	In that case, nft(8) will directly interpret any further input given until such time as it is either interrupted, encounters the end-of-file (EOF) condition, or encounters the "quit" command. In most terminal emulators, EOF can be conveyed with the Ctrl+D key combination.		In that case, nft(8) will directly interpret any further input given until such time as it is either interrupted, encounters the end-of-file (EOF) condition, or encounters the "quit" command. In most terminal emulators, EOF can be conveyed with the Ctrl+D key combination.

			Examples describing ''nftables'' grammar shall employ square brackets (U+5B, U+5D) to denote optional components of syntax, and angle brackets (U+3C, U+3D) to denote user-specified values.

	= Adding base chains =		= Adding base chains =

Plushkava: Extremely minor changes to Syntactic conventions

2024-10-08T21:59:23Z

Extremely minor changes to Syntactic conventions

← Older revision		Revision as of 21:59, 8 October 2024
Line 3:		Line 3:
	= Syntactic conventions =		= Syntactic conventions =

	Naturally, in order to make use of ''nftables'' commands and directives, it is necessary to become familiar with them, along with their supported grammar. Even with that knowledge, users sometimes experience difficulties where passing nftables commands as arguments to the nft(8) utility. That's because shells recognise certain characters as metacharacters and treat them in a special way unless they are quoted.		Naturally, in order to make use of ''nftables'' commands and directives, it is necessary to become familiar with them, along with their supported grammar. Even with that knowledge, users sometimes experience difficulties where passing ''nftables'' commands as arguments to the nft(8) utility. That's because shells recognise certain characters as metacharacters and treat them in a special way unless they are quoted.

	Throughout this article, examples that begin with the hash character (#) can be taken as examples of valid shell code. That is, they are syntactically valid if entered into any implementation of the Shell Command Language, including bash. By contrast, examples that do not begin with the hash character can be interpreted as synopses of ''nftables'' grammar, similar in style to the nft(8) man page.		Throughout this article, examples that begin with the hash character (#) can be taken as examples of valid shell code. That is, they are syntactically valid if entered into any implementation of the Shell Command Language, including bash. By contrast, examples that do not begin with the hash character can be interpreted as synopses of ''nftables'' grammar, similar in style to the nft(8) man page.
Line 13:		Line 13:
	</source>		</source>

	Note that enclosing the ''nftables'' ~~command(s)~~ within single quotes is a straightforward way of preventing the shell from interpreting characters as metacharacters, most notably the semicolon. Rather, the shell will consider all that is between the pair of single quotes as a single word before it on to the nft(8) utility as single argument, verbatim. Another way to prevent the shell from attempting to parse metacharacters is to run nft(8) in its interactive mode.		Note that enclosing the ''nftables'' commands within single quotes is a straightforward way of preventing the shell from interpreting characters as metacharacters, most notably the semicolon. Rather, the shell will consider all that is between the pair of single quotes as a single word before passing it on to the nft(8) utility as a single argument, verbatim. Another way to prevent the shell from attempting to parse metacharacters is to run nft(8) in its interactive mode.

	<source>		<source>

Plushkava: Add a "Syntactic conventions" section in an attempt to bring the standard closer to that of formal documentation; have it subsume the aside regarding matters of shell quoting that was previously in the "Adding base chains" section

2024-10-08T21:56:30Z

Add a "Syntactic conventions" section in an attempt to bring the standard closer to that of formal documentation; have it subsume the aside regarding matters of shell quoting that was previously in the "Adding base chains" section

@@ Line 1: / Line 1: @@
 As in ''iptables'', with ''nftables'' you attach your [[Simple rule management|rules]] to chains. Unlike in ''iptables'', there are no predefined chains like INPUT, OUTPUT, etc. Instead, to filter packets at a particular processing step, you explicitly create a '''base chain''' with name of your choosing, and attach it to the appropriate [[Netfilter hooks | Netfilter hook]]. This allows very flexible configurations without slowing Netfilter down with built-in chains not needed by your ruleset.
 = Adding base chains =
@@ Line 14: / Line 34: @@
 # nft 'add chain ip filter input { type filter hook input priority 0; }'
 </source>
 The ''add chain'' command registers the ''input'' chain, that it attached to the ''input'' hook so it will see packets that are addressed to the local processes.

Plushkava: Introduce nft grammar with a consistent style of English; make the flush chain example an example of grammar rather than an example of a shell command (just like how the section on deleting begins)

2024-10-08T21:22:05Z

Introduce nft grammar with a consistent style of English; make the flush chain example an example of grammar rather than an example of a shell command (just like how the section on deleting begins)

← Older revision		Revision as of 21:22, 8 October 2024
Line 3:		Line 3:
	= Adding base chains =		= Adding base chains =

	Base chains are those that are registered into the [[Netfilter hooks]], i.e. these chains see packets flowing through your Linux TCP/IP stack.		Base chains are those that are registered into the [[Netfilter hooks]], i.e. these chains see packets flowing through your Linux TCP/IP stack. The syntax for adding base chains is as follows.

	The syntax ~~to add a~~ base ~~chain~~ is:

	<source>		<source>
Line 121:		Line 119:
	= Adding regular chains =		= Adding regular chains =

	You can also create regular chains, analogous to ''iptables'' user-defined chains:		You can also create regular chains, analogous to ''iptables'' user-defined chains, the syntax for which is as follows.

	<source>		<source>
Line 133:		Line 131:
	= Deleting chains =		= Deleting chains =

	~~You can delete~~ chains as:		The syntax for deleting chains is as follows.

	<source>		<source>
Line 152:		Line 150:
	= Flushing chains =		= Flushing chains =

	To flush (delete all of the rules ~~in) the chain ''input'' of the ''filter'' table associated with the ''ip' family:~~		To flush a chain means to delete all of the rules that it contains, if any. The syntax for doing so is as follows.

	<source>		<source>
	~~# nft '~~flush chain ~~ip filter input'~~		flush chain [family] <table_name> <chain_name>
	</source>		</source>

Plushkava: Employ a chain name of eth0_filter rather than dev0filter in the ingress hook example (it seems a little clearer)

2024-10-08T20:57:10Z

Employ a chain name of eth0_filter rather than dev0filter in the ingress hook example (it seems a little clearer)

← Older revision		Revision as of 20:57, 8 October 2024
Line 49:		Line 49:
	When adding a chain on '''ingress''' hook, it is mandatory to specify the device where the chain will be attached:		When adding a chain on '''ingress''' hook, it is mandatory to specify the device where the chain will be attached:
	<source>		<source>
	# nft 'add chain netdev filter ~~dev0filter~~ { type filter hook ingress device eth0 priority 0; }'		# nft 'add chain netdev filter eth0_filter { type filter hook ingress device eth0 priority 0; }'
	</source>		</source>

Plushkava: Consistently use table/chain names that reflect iptables norms, just as the final block already does

2024-10-08T20:49:22Z

Consistently use table/chain names that reflect iptables norms, just as the final <source> block already does

← Older revision		Revision as of 20:49, 8 October 2024
Line 14:		Line 14:

	<source>		<source>
	# nft 'add chain ip ~~foo~~ input { type filter hook input priority 0; }'		# nft 'add chain ip filter input { type filter hook input priority 0; }'
	</source>		</source>

Line 32:		Line 32:

	<source>		<source>
	# nft 'add chain ip ~~foo~~ output { type filter hook output priority 0; }'		# nft 'add chain ip filter output { type filter hook output priority 0; }'
	</source>		</source>

Line 42:		Line 42:

	<source>		<source>
	# nft 'add chain ip ~~foo~~ output { type filter hook output priority 0; policy accept; }'		# nft 'add chain ip filter output { type filter hook output priority 0; policy accept; }'
	</source>		</source>

Line 49:		Line 49:
	When adding a chain on '''ingress''' hook, it is mandatory to specify the device where the chain will be attached:		When adding a chain on '''ingress''' hook, it is mandatory to specify the device where the chain will be attached:
	<source>		<source>
	# nft 'add chain netdev ~~foo~~ dev0filter { type filter hook ingress device eth0 priority 0; }'		# nft 'add chain netdev filter dev0filter { type filter hook ingress device eth0 priority 0; }'
	</source>		</source>

Line 80:		Line 80:

	<pre>		<pre>
	table ~~inet~~ filter {		table ip filter {
	# This chain is evaluated first due to priority		# This chain is evaluated first due to priority
	chain services {		chain services {
Line 142:		Line 142:

	<source>		<source>
	# nft 'delete chain ip ~~foo~~ input'		# nft 'delete chain ip filter input'
	<cmdline>:1:1-28: Error: Could not delete chain: Device or resource busy		<cmdline>:1:1-28: Error: Could not delete chain: Device or resource busy
	delete chain ip ~~foo~~ input		delete chain ip filter input
	^^^^^^^^^^^^^^^^^^^^^^^^^		^^^^^^^^^^^^^^^^^^^^^^^^^^^^
	</source>		</source>

Line 152:		Line 152:
	= Flushing chains =		= Flushing chains =

	To flush (delete all of the rules in) the chain ''input'' of the ''~~foo~~'' table:		To flush (delete all of the rules in) the chain ''input'' of the ''filter'' table associated with the ''ip' family:

	<source>		<source>
	# nft 'flush chain ~~foo~~ input'		# nft 'flush chain ip filter input'
	</source>		</source>