Difference between pages "Package:Nftables" and "Hostname"

From Funtoo
(Difference between pages)
Jump to navigation Jump to search
 
 
Line 1: Line 1:
{{Ebuild
w.i.p
|Summary=Linux kernel (3.13+) firewall, NAT and packet mangling tools
|CatPkg=net-firewall/nftables
|Repository=Gentoo Portage Tree
}}
=== What is nftables? ===
'''nftables''' is the successor to [[iptables]]. It replaces the existing iptables, ip6tables, arptables and ebtables framework. It uses the Linux kernel and a new userspace utility called nft. nftables provides a compatibility layer for the ip(6)tables and framework.
 
==Introduction==
==Introduction==
As with the iptables framework, nftables is build upon rules which specify the actions. These rules are attached to chains. A chain can contain a collection of rules and is registered into the netfilter hooks. Chains are stored inside tables. A table is specific for one of the layer 3 protocols. One of the main differences with iptables is that there are no predefined tables and chains anymore.
A hostname is a unique name created to identify a machine on a network. In computer networking, a hostname  is a label that is assigned to a device connected to a computer network and that is used to identify the device in various forms of electronic communication such as the World Wide Web, e-mail or Usenet. Hostnames may be simple names consisting of a single word or phrase, or they may be structured.
 
==Configuration==
===Tables===
In Funtoo Linux <code>/etc/conf.d/hostname</code> is the only configuration file for setting a hostname. In OpenRC framework <code>/etc/conf.d/foo</code> is the configuration file for a corresponding Init script <code>/etc/init.d/foo</code>. With the case of hostname, default value in <code>/etc/conf.d/hostname</code> is set to ''localhost'', means when system boots and OpenRC's <code>/etc/init.d/hostname</code> script started a hostname getting only ''localhost'' name. How it looks? In your shell promt this will look in following way, an example for root:
A table is nothing more than a container for your chains. With nftables there are no predefined tables (filter, raw, mangle...) anymore. You are free to recreate the iptables-like structure, but anything might do.
Currently there are 5 different families of tables:
* '''ip''': Used for IPv4 related chains;
* '''ip6''': Used for IPv6 related chains;
* '''arp''': Used for ARP related chains;
* '''bridge''': Used for bridging related chains;
* '''inet''': Mixed ipv4/ipv6 chains (kernel 3.14 and up).
 
It is not hard to recognize the old tables framework in these tables. The only new one is the inet table which is used for both IPv4 and IPv6 traffic. It should make firewalling for dual-stack hosts easier by combining the rules for IPv4 and IPv6.
 
===Chains===
Chains are used to group together rules. As with the tables, nftables does not have any predefined chains. Chains are grouped in base and non-base types. Base chains are registered in one of the netfilter hooks. A base chain has a hook its registered with, a type and a priority.  Non-base chains are not attached to a hook and they don't see any traffic by default. They can be used to arrange a rule-set in a tree of chains.
There are currently three types of chains:
* '''filter''': for filtering packets
* '''route''': for rerouting packets
* '''nat''': for performing Network Address Translation. Only the first packet of a flow hits this chain, making it impossible to use it for filtering.
The hooks that can be used are:
* '''prerouting''': This is before the routing decision, all packets entering the machine hits this chain
* '''input''': All packets for the local system hits this hook
* '''forward''': Packets not for the local system, those that need to be forwarded hits this hook
* '''output''': Packets that originate from the local system pass this hook
* '''postrouting''': This hook is after the routing decision, all packets leaving the machine hits this chain
{{Note|The ARP address family only supports the input and output hook}}
{{Note|The bridge address family only seems to supports the input, forward and output hook}}
 
====Priorities====
{{Note| Priorities do not currently appear to have any effect on which chain sees packets first.}}
{{Note| Since the priority seems to be an unsigned integer, negative priorities will be converted into very high priorities.}}
 
===Rules===
Rules specify which action has to be taken for which packets. Rules are attached to chains. Each rule can has an expression to match packets with and one or multiple actions when matching. Main differences with iptables is that it is possible to specify multiple actions and that by default counters are off. It must be specified explicitly in rules if you want packet- and byte-counters for a rule.
Each rule has a unique handle number by which it can be distinguished.
The following matches are available:
* '''ip''': IP protocol
* '''ip6''': IPv6 protocol
* '''tcp''': TCP protocol
* '''udp''': UDP protocol
* '''udplite''': UDP-lite protocol
* '''sctp''': SCTP protocol
* '''dccp''': DCCP protocol
* '''ah''': Authentication headers
* '''esp''': Encrypted security payload headers
* '''ipcomp''': IPcomp headers
* '''icmp''': icmp protocol
* '''icmpv6''': icmpv6 protocol
* '''ct''': Connection tracking
* '''meta''': meta properties such as interfaces
 
====Matches====
{|class=wikitable
| Match
| Arguments
| Description/Example
|-
| rowspan="11" | '''ip'''
| version
| Ip Header version
|-
| hdrlength
| IP header length
|-
| tos
|Type of Service
|-
| length
| Total packet length
|-
| id
| IP ID
|-
| frag-off
| Fragmentation offset
|-
| ttl
| Time to live
|-
| protocol
| Upper layer protocol
|-
| checksum
| IP header checksum
|-
| saddr
| Source address
|-
| daddr
| Destination address
|-
| rowspan="8" | '''ip6'''
| version
| IP header version
|-
| priority
|
|-
| flowlabel
| Flow label
|-
| length
| Payload length
|-
| nexthdr
| Next header type (Upper layer protocol number)
|-
| hoplimit
| Hop limit
|-
|saddr
| Source Address
|-
|daddr
| Destination Address
|-
| rowspan="9" | '''tcp'''
| sport
| Source port
|-
| dport
| Destination port
|-
| sequence
| Sequence number
|-
| ackseq
| Acknowledgement number
|-
| doff
| Data offset
|-
| flags
| TCP flags
|-
| window
| Window
|-
| checksum
| Checksum
|-
| urgptr
| Urgent pointer
|-
| rowspan="4" | '''udp'''
| sport
| Source port
|-
| dport
| destination port
|-
| length
| Total packet length
|-
| checksum
| Checksum
|-
| rowspan="4" | '''udplite'''
| sport
| Source port
|-
| dport
| destination port
|-
| cscov
| Checksum coverage
|-
| checksum
| Checksum
|-
| rowspan="4" |'''sctp'''
| sport
| Source port
|-
| dport
| destination port
|-
|vtag
|Verification tag
|-
| checksum
| Checksum
|-
| rowspan="2" |'''dccp'''
| sport
| Source port
|-
| dport
| destination port
|-
| rowspan="4" |'''ah'''
| nexthdr
| Next header protocol (Upper layer protocol)
|-
| hdrlength
| AH header length
|-
| spi
| Security Parameter Index
|-
| sequence
| Sequence Number
|-
| rowspan="2" | '''esp'''
| spi
| Security Parameter Index
|-
| sequence
| Sequence Number
|-
| rowspan="3" | '''ipcomp'''
| nexthdr
| Next header protocol (Upper layer protocol)
|-
| flags
| Flags
|-
| cfi
| Compression Parameter Index
|-
| '''icmp'''
| type
| icmp packet type
|-
| '''icmpv6'''
| type
| icmpv6 packet type
|-
|rowspan="12"|'''ct'''
|state
|State of the connection
|-
|direction
|Direction of the packet relative to the connection
|-
|status
|Status of the connection
|-
|mark
|Connection mark
|-
|expiration
|Connection expiration time
|-
|helper
|Helper associated with the connection
|-
|l3proto
|Layer 3 protocol of the connection
|-
|saddr
|Source address of the connection for the given direction
|-
|daddr
|Destination address of the connection for the given direction
|-
|protocol
|Layer 4 protocol of the connection for the given direction
|-
|proto-src
|Layer 4 protocol source for the given direction
|-
|proto-dst
|Layer 4 protocol destination for the given direction
|-
| rowspan="13" | '''meta'''
| length
| Length of the packet in bytes: ''meta length > 1000''
|-
| protocol
| ethertype protocol: ''meta protocol vlan''
|-
| priority
| TC packet priority
|-
| mark
| Packet mark
|-
| iif
| Input interface index
|-
| iifname
| Input interface name
|-
| iiftype
| Input interface type
|-
| oif
| Output interface index
|-
| oifname
| Output interface name
|-
| oiftype
| Output interface hardware type
|-
| skuid
| UID associated with originating socket
|-
| skgid
| GID associated with originating socket
|-
| rtclassid
| Routing realm
|-
|}
====Statements====
Statements represent the action to be performed when the rule matches. They exist in two kinds: Terminal statements, unconditionally terminate the evaluation of the current rules and non-terminal statements that either conditionally or never terminate the current rules. There can be an arbitrary amount of non-terminal statements, but there must be only a single terminal statement.
The terminal statements can be:
* '''accept''': Accept the packet and stop the ruleset evaluation.
* '''drop''': Drop the packet and stop the ruleset evaluation.
* '''reject''': Reject the packet with an icmp message
* '''queue''': Queue the packet to userspace and stop the ruleset evaluation.
* '''continue''':
* '''return''': Return from the current chain and continue at the next rule of the last chain. In a base chain it is equivalent to accept
* '''jump <chain>''': Continue at the first rule of <chain>. It will continue at the next rule after a return statement is issued
* '''goto <chain>''': Similar to jump, but after the new chain the evaluation will continue at the last chain instead of the one containing the goto statement
 
== Installing nftables ==
=== Kernel ===
These kernel options must be set:
 
  [*] Networking support --->
    Networking options  --->
        [*] Network packet filtering framework (Netfilter)  --->
            Core Netfilter Configuration  --->
                <M> Netfilter nf_tables support
                <M>  Netfilter nf_tables IPv6 exthdr module
                <M>  Netfilter nf_tables meta module
                <M>  Netfilter nf_tables conntrack module
                <M>  Netfilter nf_tables rbtree set module
                <M>  Netfilter nf_tables hash set module
                <M>  Netfilter nf_tables counter module
                <M>  Netfilter nf_tables log module
                <M>  Netfilter nf_tables limit module
                <M>  Netfilter nf_tables nat module
                <M>  Netfilter x_tables over nf_tables module
            IP: Netfilter Configuration  --->
                <M> IPv4 nf_tables support
                <M>  nf_tables IPv4 reject support
                <M>  IPv4 nf_tables route chain support
                <M>  IPv4 nf_tables nat chain support
            IPv6: Netfilter Configuration  --->
                <M> IPv6 nf_tables support
                <M>  IPv6 nf_tables route chain support
                <M>  IPv6 nf_tables nat chain support
            <M>  Ethernet Bridge nf_tables support
 
=== Emerging ===
To install nftables, run the following command:
<console>
<console>
###i## emerge net-firewall/nftables
localhost ~ # ##i## Hello :)
</console>
</console>
 
Let's play a bit with a configuration. Open <code>/etc/conf.d/hostname</code> with your favorite editor and set a hostname of your choice.  Below, I will use a real examples  from one of my working test boxes.
 
== OpenRC configuration ==
Don't forget to add nftables service to startup:
<console>
<console>
###i## rc-update add nftables default
localhost ~ # ##i## nano /etc/conf.d/hostname
</console>
</console>
 
Let's set it to hostname="oleg-stable.host.funtoo.org". Save the file and restart  a hostname service:
You cannot use iptables and nft to perform NAT at the same time. So make sure that the iptable_nat module is unloaded. Remove iptables_nat module:
<console>
<console>
###i## rmmod iptable_nat
localhost ~ # ##i## service hostname restart
</console>
</console>
 
Now, let's examine our changes, after a restarting a hostname
Start nftables:
<console>
<console>
###i## /etc/init.d/nftables start
oleg-stable ~ # ##i## Hello :)
</console>
</console>
 
== Diving deeper==
 
Notice, that in above output we seeing a shortened hostname and not a FQDN (Fully Qualified Domain Name). Don't be frustrated. This is  how  default bash promt <code>PS1</code> set. To get nice promts, please, consult http://www.funtoo.org/Prompt_Magic
== Using nftables ==
Another way to test our settings is using a '''hostname''' command. Here we will show only  some of it's features. Let's try to execute '''hostname''' command:
All nftable commands are done with the nft ultility from {{Package|net-firewall/nftables}}.
===Tables===
====Creating tables====
The following command adds a table called filter for the ip(v4) layer
<console>
<console>
###i## nft add table ip filter
oleg-stable ~ # ##i## hostname
oleg-stable.host.funtoo.org
</console>
</console>
Likewise a table for arp can be created with
Now we see our fully qualified domain name hostname just how we configured it in <code>/etc/conf.d/hostname</code> in above paragraph. To get a short hostname we need to set '''-s ''' (short) argument to hostname command.
<console>
<console>
###i## nft add table arp filter
oleg-stable ~ # ##i## hostname -s
oleg-stable
</console>
</console>
{{Note|The name "filter" used here is completly arbitrary. It could have any name}}
Good! Hostname offers more then just displaying a system host name but can also set one. Let's try:
====Listing tables====
The following command lists all tables for the ip(v4) layer
<console>
<console>
###i## nft list tables ip
oleg-stable ~ # ##i## hostname foo.bar.baz
oleg-stable ~ # ##i## hostname
foo.bar.baz
</console>
</console>
<pre>
As you can see, we changed a hostname on-the-fly. This is not recommended way.
table filter
{{fancywarning|Please, notice that using '''hostname''' command to configure will work temporary for a current session and will be reverted back to a value set in <code>/etc/conf.d/hostname</code> file with next system restart.}}
</pre>
The contents of the table filter can be listed with:
<console>
###i## nft list table ip filter
</console>
<pre>
table ip filter {
        chain input {
                type filter hook input priority 0;
                ct state established,related accept
                iifname "lo" accept
                ip protocol icmp accept
                drop
        }
}
</pre>
using -a with the nft command, it shows the handle of each rule. Handles are used for various operations on specific rules:
<console>
###i## nft -a list table ip filter
</console>
<pre>
table ip filter {
        chain input {
                type filter hook input priority 0;
                ct state established,related accept # handle 2
                iifname "lo" accept # handle 3
                ip protocol icmp accept # handle 4
                drop # handle 5
        }
}
</pre>


====Deleting tables====
Now that we got a brief description of a hostname and basic configuration steps, its time to reflect another important case which is directly related to a Funtoo Linux hostname generation, a hosts.
The following command deletes the table called filter for the ip(v4) layer:
<console>
###i## nft delete table ip filter
</console>
===chains===
====Adding chains====
The following command adds a chain called input to the ip filter table and registered to the input hook with priority 0. It is of the type filter.
<console>
###i## nft add chain ip filter input { type filter hook input priority 0 \; }
</console>
{{Note|If You're running this command from Bash you need to escape the semicolon}}
A non-base chain can be added by not specifying the chain configurations between the curly braces.


====Removing chains====
==Hosts case==
The following command deletes the chain called input
As per man page <code>hosts</code> stands for static table lookup for hostnames and it's configuration file is <code>/etc/hosts</code>. Here is how it looks
<console>
{{file|name=/etc/hosts|body=
###i## nft delete chain ip filter input
# Auto-generated hostname. Please do not remove this comment.
</console>
127.0.0.1      oleg-stable.host.funtoo.org oleg-stable localhost localhost.localdomain
{{Note|Chains can only be deleted if there are no rules in them.}}
::1            oleg-stable.host.funtoo.org oleg-stable localhost localhost.localdomain
===rules===
}}
====Adding rules====
As you can see it has entries from our <code>/etc/conf.d/hostname</code>. As you may have guessed, in Funtoo Linux <code>/etc/hosts</code> file entries are auto-generated, when OpenRC hostname service starts. Previously, it is used to edit <code>/etc/hosts</code> manually. In Funtoo Linux there is no such need.
The following command adds a rule to the chain called input, on the ip filter table, dropping all traffic to port 80:
<console>
###i## nft add rule ip filter input tcp dport 80 drop
</console>
====Deleting Rules====
To delete a rule, you first need to get the handle number of the rule. This can be done by using the -a flag on nft:
<console>
###i## nft  rule ip filter input tcp dport 80 drop
</console>
<pre>
table ip filter {
        chain input {
                type filter hook input priority 0;
                tcp dport http drop # handle 2
        }
}
</pre>
It is then possible to delete the rule with:
<console>
###i## nft delete rule ip filter input handle 2
</console>
== Management ==
=== Backup ===
You can also backup your rules:
<console>
###i## echo "nft flush ruleset" > backup.nft
</console>
 
<console>
###i## nft list ruleset >> backup.nft
</console>
 
=== Restoration ===
And load it atomically:
<console>
###i## nft -f backup.nft
</console>
 
== OpenRC configuration ==
 
Don't forget to add nftables service to startup:
<console>
###i## rc-update add nftables default
</console>
== Init script - firewall nftables like a firewall iptables ==
<pre>
#!/sbin/runscript
#      Raphael Bastos aka coffnix        #
#      Init Script for Funtoo Linux      #
##########################################
 
depend() {
        need net
        need nftables
        }
 
start(){
##################### PARTE 1 #####################
ebegin "Starting Firewall NFTables"
 
#######################################################################
### Incompatibilities ###
# You cannot use iptables and nft to perform NAT at the same time.
# So make sure that the iptable_nat module is unloaded
rmmod iptable_nat
 
#######################################################################
 
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/ip_dynaddr
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
for f in /proc/sys/net/ipv4/conf/*/rp_filter ; do echo 1 > $f ; done
 
#######################################################################
 
iptables -t nat -F
 
#######################################################################
 
# ipv4
nft -f /etc/nftables/ipv4-filter
 
# ipv4 nat
nft -f /etc/nftables/ipv4-nat
 
# ipv6
nft -f /etc/nftables/ipv6-filter
 
# Rules firewall NTFtables
nft -f /etc/nftables/firewall.rules
 
#######################################################################
 
}
 
stop(){
ebegin "Stoping Firewall NFTables"
 
#######################################################################
 
#iptables -t nat -F
NFT=nft
FAMILIES="ip ip6 arp bridge"
 
for FAMILY in $FAMILIES; do
  TABLES=$($NFT list tables $FAMILY | grep "^table\s" | cut -d' ' -f2)
 
  for TABLE in $TABLES; do
    CHAINS=$($NFT list table $FAMILY $TABLE | grep "^\schain\s" | cut -d' ' -f2)
 
    for CHAIN in $CHAINS; do
      echo "Flushing chain: $FAMILY->$TABLE->$CHAIN"
      $NFT flush chain $FAMILY $TABLE $CHAIN
      $NFT delete chain $FAMILY $TABLE $CHAIN
    done
 
    echo "Flushing table: $FAMILY->$TABLE"
    $NFT flush table $FAMILY $TABLE
    $NFT delete table $FAMILY $TABLE
  done
done
}
 
status(){
nft list ruleset
}
 
# End
</pre>
 
[[Category:System]]
[[Category:First Steps]]
{{EbuildFooter}}

Revision as of 06:37, February 23, 2015

w.i.p

Introduction

A hostname is a unique name created to identify a machine on a network. In computer networking, a hostname is a label that is assigned to a device connected to a computer network and that is used to identify the device in various forms of electronic communication such as the World Wide Web, e-mail or Usenet. Hostnames may be simple names consisting of a single word or phrase, or they may be structured.

Configuration

In Funtoo Linux /etc/conf.d/hostname is the only configuration file for setting a hostname. In OpenRC framework /etc/conf.d/foo is the configuration file for a corresponding Init script /etc/init.d/foo. With the case of hostname, default value in /etc/conf.d/hostname is set to localhost, means when system boots and OpenRC's /etc/init.d/hostname script started a hostname getting only localhost name. How it looks? In your shell promt this will look in following way, an example for root: 

localhost ~ #  Hello :)

Let's play a bit with a configuration. Open /etc/conf.d/hostname with your favorite editor and set a hostname of your choice. Below, I will use a real examples from one of my working test boxes. 

localhost ~ #  nano /etc/conf.d/hostname

Let's set it to hostname="oleg-stable.host.funtoo.org". Save the file and restart a hostname service: 

localhost ~ #  service hostname restart

Now, let's examine our changes, after a restarting a hostname 

oleg-stable ~ #  Hello :)

Diving deeper

Notice, that in above output we seeing a shortened hostname and not a FQDN (Fully Qualified Domain Name). Don't be frustrated. This is how default bash promt PS1 set. To get nice promts, please, consult http://www.funtoo.org/Prompt_Magic Another way to test our settings is using a hostname command. Here we will show only some of it's features. Let's try to execute hostname command: 

oleg-stable ~ #  hostname
oleg-stable.host.funtoo.org

Now we see our fully qualified domain name hostname just how we configured it in /etc/conf.d/hostname in above paragraph. To get a short hostname we need to set -s (short) argument to hostname command. 

oleg-stable ~ #  hostname -s
oleg-stable

Good! Hostname offers more then just displaying a system host name but can also set one. Let's try: 

oleg-stable ~ #  hostname foo.bar.baz
oleg-stable ~ #  hostname 
foo.bar.baz

As you can see, we changed a hostname on-the-fly. This is not recommended way.

   Warning

Please, notice that using hostname command to configure will work temporary for a current session and will be reverted back to a value set in /etc/conf.d/hostname file with next system restart.

Now that we got a brief description of a hostname and basic configuration steps, its time to reflect another important case which is directly related to a Funtoo Linux hostname generation, a hosts.

Hosts case

As per man page hosts stands for static table lookup for hostnames and it's configuration file is /etc/hosts. Here is how it looks

   /etc/hosts 
# Auto-generated hostname. Please do not remove this comment.
127.0.0.1       oleg-stable.host.funtoo.org oleg-stable localhost localhost.localdomain
::1             oleg-stable.host.funtoo.org oleg-stable localhost localhost.localdomain

As you can see it has entries from our /etc/conf.d/hostname. As you may have guessed, in Funtoo Linux /etc/hosts file entries are auto-generated, when OpenRC hostname service starts. Previously, it is used to edit /etc/hosts manually. In Funtoo Linux there is no such need.

Retrieved from "https://www.funtoo.org/index.php?title=Package:Nftables&oldid=9167"