Nftables : Enable Service2025/01/03

This is the Basic Operation of Nftables.

Nftables is a tool that integrates the functions of traditional iptables, ip6tables, arptables, and ebtables.

[1]

On RHEL / CentOS Stream, nftables is used ad the default Firewalld backend.

[root@dlp ~]#

grep ^FirewallBackend /etc/firewalld/firewalld.conf

FirewallBackend=nftables

[2]	If you use nftables directly, disable firewalld service to avoid that the different firewall services influence each other. Furthermore, enable nftables.service that restores filtering ruleset when system restarts.

[root@dlp ~]#

systemctl disable --now firewalld

Removed '/etc/systemd/system/multi-user.target.wants/firewalld.service'.
Removed '/etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service'.

[root@dlp ~]#

systemctl enable --now nftables

Created symlink '/etc/systemd/system/multi-user.target.wants/nftables.service' → '/usr/lib/systemd/system/nftables.service'.

# [nftables.service] restores ruleset from [/etc/sysconfig/nftables.conf]

[root@dlp ~]#

systemctl cat nftables.service

# /usr/lib/systemd/system/nftables.service
[Unit]
Description=Netfilter Tables
Documentation=man:nft(8)
Wants=network-pre.target
Before=network-pre.target

[Service]
Type=oneshot
ProtectSystem=full
ProtectHome=true
ExecStart=/sbin/nft -f /etc/sysconfig/nftables.conf
ExecReload=/sbin/nft 'flush ruleset; include "/etc/sysconfig/nftables.conf";'
ExecStop=/sbin/nft flush ruleset
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target

# [/etc/sysconfig/nftables.conf] has no setting by default

[root@dlp ~]#

cat /etc/sysconfig/nftables.conf

# Uncomment the include statement here to load the default config sample
# in /etc/nftables for nftables service.

#include "/etc/nftables/main.nft"

# To customize, either edit the samples in /etc/nftables, append further
# commands to the end of this file or overwrite it after first service
# start by calling: 'nft list ruleset >/etc/sysconfig/nftables.conf'.

[3]	If you switch to nftables service with using the ruleset configured on Firewalld, configure like follows.

# confirm Firewalld rules ( based on that firewalld is running )

[root@dlp ~]#

firewall-cmd --list-all

public (default, active)
  target: default
  ingress-priority: 0
  egress-priority: 0
  icmp-block-inversion: no
  interfaces: enp1s0
  sources:
  services: cockpit dhcpv6-client ssh
  ports:
  protocols:
  forward: yes
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

# confirm current ruleset of nftables as the Firewalld backend

[root@dlp ~]#

nft list ruleset

table inet firewalld { # progname firewalld
        flags owner,persist

        chain mangle_PREROUTING {
                type filter hook prerouting priority mangle + 10; policy accept;
                jump mangle_PREROUTING_POLICIES
        }

        chain mangle_PREROUTING_POLICIES {
                iifname "enp1s0" jump mangle_PRE_policy_allow-host-ipv6
                iifname "enp1s0" jump mangle_PRE_public
                iifname "enp1s0" return
                jump mangle_PRE_policy_allow-host-ipv6
                jump mangle_PRE_public
                return
        }
.....
.....

# output the current ruleset to [/etc/sysconfig/nftables.conf]

[root@dlp ~]#

nft list ruleset > /etc/sysconfig/nftables.conf

# disable firewalld service & enable nftables service

[root@dlp ~]#

systemctl disable --now firewalld

[root@dlp ~]#

systemctl enable --now nftables

# confirm ruleset

[root@dlp ~]#

nft list ruleset

table inet firewalld {
        flags persist

        chain mangle_PREROUTING {
                type filter hook prerouting priority mangle + 10; policy accept;
                jump mangle_PREROUTING_POLICIES
        }
.....
.....

# for example, it's possible to show settings of allowed services [services: cockpit dhcpv6-client ssh] on [firewalld] like follows

[root@dlp ~]#

nft list chain inet firewalld filter_IN_public_allow

table inet firewalld {
        chain filter_IN_public_allow {
                tcp dport 22 accept
                ip6 daddr fe80::/64 udp dport 546 accept
                tcp dport 9090 accept
        }
}

Matched Content