Flowtables - Revision history

Pablo: remove ct state established in flow add rule

2025-04-18T00:53:59Z

remove ct state established in flow add rule

← Older revision		Revision as of 00:53, 18 April 2025
Line 68:		Line 68:

	# offload established HTTP connections		# offload established HTTP connections
	tcp dport { 80, 443 } ~~ct state established~~ flow add @f counter packets 0 bytes 0		tcp dport { 80, 443 } flow add @f counter packets 0 bytes 0

	# Allow traffic from established and related packets, drop invalid		# Allow traffic from established and related packets, drop invalid

Pablo: replace flow offload by flow add

2025-04-04T17:37:07Z

replace flow offload by flow add

← Older revision		Revision as of 17:37, 4 April 2025
Line 25:		Line 25:
	__\/___ \| \| forward \|------------ \|		__\/___ \| \| forward \|------------ \|
	\|-----\| \| \_________/ \|		\|-----\| \| \_________/ \|
	\|-----\| \| 'flow ~~offload~~' rule \|		\|-----\| \| 'flow add' rule \|
	\|-----\| \| adds entry to \|		\|-----\| \| adds entry to \|
	\|_____\| \| flowtable \|		\|_____\| \| flowtable \|
Line 68:		Line 68:

	# offload established HTTP connections		# offload established HTTP connections
	tcp dport { 80, 443 } ct state established flow ~~offload~~ @f counter packets 0 bytes 0		tcp dport { 80, 443 } ct state established flow add @f counter packets 0 bytes 0

	# Allow traffic from established and related packets, drop invalid		# Allow traffic from established and related packets, drop invalid
Line 82:		Line 82:
	Note that:		Note that:

	# The rule that uses the ''flow ~~offload~~'' statement determines what flows are added to the flowtable. This ruleset above adds entries to the flowtable for established HTTP connections.		# The rule that uses the ''flow add'' statement determines what flows are added to the flowtable. This ruleset above adds entries to the flowtable for established HTTP connections.
	# The devices you specify in the flowtable declaration determine where the flowtable hooks in the pipeline for lookups, in the example above, it registers a hook for devices eth0 and eth1 in the ingress hook at priority 0.		# The devices you specify in the flowtable declaration determine where the flowtable hooks in the pipeline for lookups, in the example above, it registers a hook for devices eth0 and eth1 in the ingress hook at priority 0.

Danw at 16:58, 28 October 2024

2024-10-28T16:58:38Z

← Older revision		Revision as of 16:58, 28 October 2024
Line 83:		Line 83:

	# The rule that uses the ''flow offload'' statement determines what flows are added to the flowtable. This ruleset above adds entries to the flowtable for established HTTP connections.		# The rule that uses the ''flow offload'' statement determines what flows are added to the flowtable. This ruleset above adds entries to the flowtable for established HTTP connections.
	# The devices you specify in the flowtable declaration determine where the flowtable hooks in the pipeline for lookups, in the example above, it registers a hook for devices eth0 and ~~eth0~~ in the ingress hook at priority 0.		# The devices you specify in the flowtable declaration determine where the flowtable hooks in the pipeline for lookups, in the example above, it registers a hook for devices eth0 and eth1 in the ingress hook at priority 0.

	== See also ==		== See also ==

Pablo: update notes according to HTTP connection offload

2023-08-22T18:26:44Z

update notes according to HTTP connection offload

← Older revision		Revision as of 18:26, 22 August 2023
Line 82:		Line 82:
	Note that:		Note that:

	# The rule that uses the ''flow offload'' statement determines what flows are added to the flowtable. This ruleset above adds entries to the flowtable for ~~TCP and UDP packets~~.		# The rule that uses the ''flow offload'' statement determines what flows are added to the flowtable. This ruleset above adds entries to the flowtable for established HTTP connections.
	# The devices you specify in the flowtable declaration determine where the flowtable hooks in the pipeline for lookups, in the example above, it registers a hook for devices eth0 and eth0 in the ingress hook at priority 0.		# The devices you specify in the flowtable declaration determine where the flowtable hooks in the pipeline for lookups, in the example above, it registers a hook for devices eth0 and eth0 in the ingress hook at priority 0.

Pablo: provide an example that offload HTTP traffic

2023-08-22T18:25:19Z

provide an example that offload HTTP traffic

← Older revision		Revision as of 18:25, 22 August 2023
Line 51:		Line 51:
	The devices are specified as [[Data_types\|iifname]](s) of the input interface(s) of the traffic that should be offloaded. Devices are required for both traffic directions.		The devices are specified as [[Data_types\|iifname]](s) of the input interface(s) of the traffic that should be offloaded. Devices are required for both traffic directions.

	Example:		An Example to offload HTTP traffic for a router:

	<pre>		<pre>
			define DEV_PRIVATE=eth0
			define DEV_INTERNET=eth1

	table inet x {		table inet x {

	flowtable f {		flowtable f {
	hook ingress priority 0; devices = { ~~eth0~~, ~~eth1~~ };		hook ingress priority 0
			devices = { $DEV_PRIVATE, $DEV_INTERNET }
	}		}

Line 63:		Line 67:
	type filter hook forward priority 0; policy drop;		type filter hook forward priority 0; policy drop;

	# offload established connections		# offload established HTTP connections
	~~meta l4proto~~ { ~~tcp~~, ~~udp~~ } flow offload @f counter packets 0 bytes 0		tcp dport { 80, 443 } ct state established flow offload @f counter packets 0 bytes 0

	# established/related ~~connections~~		# Allow traffic from established and related packets, drop invalid
	ct state established,related ~~counter~~ accept		ct state vmap { established : accept, related : accept, invalid : drop }

	# ~~allow initial connection~~		# connections from the internal net to the internet or to other
	~~meta l4proto { tcp, udp }~~ accept		# internal nets are allowed
			iifname $DEV_PRIVATE counter accept
	}		}
	}		}

Pablo: add a few notes

2023-08-22T18:05:50Z

add a few notes

← Older revision		Revision as of 18:05, 22 August 2023
Line 1:		Line 1:
	~~'''NOTE''': [[Meters]] were formerly known as flowtables before nftables 0.8.1 release. Now they are 2 separated, unrelated things.~~

	Flowtables allow you to accelerate packet forwarding in software (and in hardware if your NIC supports it) by using a conntrack-based network stack bypass.		Flowtables allow you to accelerate packet forwarding in software (and in hardware if your NIC supports it) by using a conntrack-based network stack bypass.

Line 66:		Line 64:

	# offload established connections		# offload established connections
	~~ip protocol~~ { tcp, udp } flow offload @f		meta l4proto { tcp, udp } flow offload @f counter packets 0 bytes 0
	~~ip6 nexthdr { tcp, udp } flow offload @f~~
	counter packets 0 bytes 0

	# established/related connections		# established/related connections
Line 74:		Line 70:

	# allow initial connection		# allow initial connection
	~~ip protocol { tcp, udp } accept~~		meta l4proto { tcp, udp } accept
	~~ip6 nexthdr~~ { tcp, udp } accept
	}		}
	}		}
	</pre>		</pre>

			Note that:

			# The rule that uses the ''flow offload'' statement determines what flows are added to the flowtable. This ruleset above adds entries to the flowtable for TCP and UDP packets.
			# The devices you specify in the flowtable declaration determine where the flowtable hooks in the pipeline for lookups, in the example above, it registers a hook for devices eth0 and eth0 in the ingress hook at priority 0.

	== See also ==		== See also ==

Plushkava: Add missing semi-colon in hook.

2022-06-24T06:35:20Z

Add missing semi-colon in hook.

← Older revision		Revision as of 06:35, 24 June 2022
Line 59:		Line 59:

	flowtable f {		flowtable f {
	hook ingress priority 0 devices = { eth0, eth1 };		hook ingress priority 0; devices = { eth0, eth1 };
	}		}

Sven at 07:43, 27 April 2022

2022-04-27T07:43:14Z

← Older revision		Revision as of 07:43, 27 April 2022
Line 43:		Line 43:
	Flowtables reside in the ingress hook that is located before the prerouting hook. You can select which flows you want to offload through the flow expression from the forward chain. Flowtables are identified by their address [[Nftables_families\|family]] and their name. The address family must be one of ip, ip6, or inet. When no address family is specified, ip is used by default.		Flowtables reside in the ingress hook that is located before the prerouting hook. You can select which flows you want to offload through the flow expression from the forward chain. Flowtables are identified by their address [[Nftables_families\|family]] and their name. The address family must be one of ip, ip6, or inet. When no address family is specified, ip is used by default.

	Flows are offloaded after the state is created. A firewall rule to accept the initial traffic is required.		Flows are offloaded after the state is created. That means that usually the first reply packet will create the flowtable entry.
			A firewall rule to accept the initial traffic is required.
	The flow expression on the forward chain must match the return traffic of the initial connection.		The flow expression on the forward chain must match the return traffic of the initial connection.
			Be aware that the return route is deducted from the packet, that creates the flowtable entry.
			This also means if you are using special ip rules, you need to make sure that they match the reply packet traffic as well as the original traffic.

	The priority can be a signed integer or filter which stands for 0. Addition and subtraction can be used to set relative priority, e.g. filter + 5 equals to 5.		The priority can be a signed integer or filter which stands for 0. Addition and subtraction can be used to set relative priority, e.g. filter + 5 equals to 5.

Pablo at 18:39, 27 May 2021

2021-05-27T18:39:22Z

← Older revision		Revision as of 18:39, 27 May 2021
Line 79:		Line 79:
	== See also ==		== See also ==

	* [https://www.kernel.org/doc/~~Documentation~~/networking/nf_flowtable.~~txt~~ Linux kernel documentation on Netfilter flowtable]		* [https://www.kernel.org/doc/html/latest/networking/nf_flowtable.html Linux kernel documentation on Netfilter flowtable]
	* [https://netdevconf.info/0x13/session.html?workshop-netfilter-mini Netfilter Mini-Workshop, Netdev 0x13, 2019-03]		* [https://netdevconf.info/0x13/session.html?workshop-netfilter-mini Netfilter Mini-Workshop, Netdev 0x13, 2019-03]
	* [https://lwn.net/Articles/804384/ Mellanox flowtable hardware offload]		* [https://lwn.net/Articles/804384/ Mellanox flowtable hardware offload]
	* [https://www.programmersought.com/article/11833283913/ Some Mellanox flowtable hardware offload performance measurements by Wen Xu of UCloud]		* [https://www.programmersought.com/article/11833283913/ Some Mellanox flowtable hardware offload performance measurements by Wen Xu of UCloud]
	* [https://linuxplumbersconf.org/event/4/contributions/463/ Netfilter hardware offloads, Pablo Neira Ayuso, Linux Plumbers Conference, 2019-09]		* [https://linuxplumbersconf.org/event/4/contributions/463/ Netfilter hardware offloads, Pablo Neira Ayuso, Linux Plumbers Conference, 2019-09]

Fmyhr: Fmyhr moved page Flowtable to Flowtables: Use plural page title like the other objects. Will update links immediately.

2021-04-16T22:51:15Z

Fmyhr moved page Flowtable to Flowtables: Use plural page title like the other objects. Will update links immediately.

← Older revision		Revision as of 22:51, 16 April 2021
(No difference)