Nftables - Revision history

WhyNotHugo: /* See also */

2026-01-28T00:21:29Z

John3-16: 1. Consolidated packaged rules passages (partly repetitive despite prior useful edits); 2. 'Packaged rules' section made subsection of Configuration, adding subheadings for downloading/enabling and reloading steps; 3. Added 'reload' passage, indicating that nftables is not a daemon so it will not appear under rc-status; 4. /See also / Added Tutorials and Howtos - Firewall; 5. Style/grammar amendments.

2026-01-03T01:37:50Z

1. Consolidated packaged rules passages (partly repetitive despite prior useful edits); 2. 'Packaged rules' section made subsection of Configuration, adding subheadings for downloading/enabling and reloading steps; 3. Added 'reload' passage, indicating that nftables is not a daemon so it will not appear under rc-status; 4. See also: Added Tutorials and Howtos - Firewall; 5. Style/grammar amendments.

← Older revision		Revision as of 01:37, 3 January 2026
Line 1:		Line 1:
	{{DISPLAYTITLE:nftables}}The [https://netfilter.org/projects/nftables nftables] project provides ~~user-space~~ tools to control the Linux nftables subsystem.		{{DISPLAYTITLE:nftables}}The [https://netfilter.org/projects/nftables nftables] project provides userspace tools to control the Linux nftables subsystem.

	== Installation ==		== Installation ==

	To use {{ic\|nft}} command from {{Pkg\|nftables}} package, install it first:{{Cmd\|# apk add {{Pkg\|nftables}}}}		To use the {{ic\|nft}} command from the {{Pkg\|nftables}} package, install it first:{{Cmd\|# apk add {{Pkg\|nftables}}}}

	== Configuration ==		== Configuration ==

	The default ~~<code>nftable</code>~~ rules ~~shipped~~ will block all incoming connections. A service that loads the rules from {{~~path~~\|/etc/nftables.d}} folder can be enabled with: {{Cmd\|~~<nowiki>~~# rc-~~update add~~ nftables ~~boot~~		The default {{ic\|nftables}}-shipped rules will block all incoming connections. The service that loads the rules from the {{Path\|/etc/nftables.d}} folder can be enabled with: {{Cmd\|# rc-service nftables start}}
	# rc-~~service~~ nftables ~~start</nowiki>~~}}		Make it start on future sessions also:
			{{Cmd\|# rc-update add nftables boot}}
			However, there may be further packaged rules shipped with additional installed packages.

	~~If {{ic\|nftables}}~~ rules are in {{Path\|/usr/share/nftables.avail}} folder, they must be symlinked to {{path\|/etc/nftables.d}} folder to enable them. For e.g if there is a rule {{Path\|/usr/share/nftables.avail/sshd.nft}}, issue the below command:{{Cmd\|# ln -s /usr/share/nftables.avail/sshd.nft /etc/nftables.d/sshd.nft}}		=== Packaged rules ===

	== ~~Packaged~~ rules ==		==== Downloading and enabling rules ====

	~~Server~~ software packages that are accompanied by an <code>-nftrules</code> package ~~includes~~ the typical default rules to expose the server. ~~For example,~~ {{pkg\|openssh-nftrules}} package will open the default port(s) used by {{pkg\|openssh}}. On Alpine Linux Edge and from v3.23 onwards, all <code>-nftrules</code> that are available for your current installation, as well as for any future package to be installed, can be downloaded by installing {{Pkg\|nftables-rulesets}} on the main repo:		If there are {{ic\|nftables}} rules elsewhere, in the {{Path\|/usr/share/nftables.avail}} folder, then they must be enabled: server software packages that are accompanied by an <code>-nftrules</code> package, for example, include the typical default rules to expose the server, but the rules are only downloaded and must then be enabled e.g. the {{pkg\|openssh-nftrules}} package will only download rules to open the default port(s) used by {{pkg\|openssh}}.
	~~{{Cmd\|$ doas apk add nftables-rulesets}}~~

	These rules are not active upon package installation~~. They~~ are ~~installed in the <code>~~/usr/share/nftables.avail/~~</code>~~ directory. The user can either ~~symlink~~ them individually to ~~<code>~~/etc/nftables.d/</~~code>~~, or ~~add this~~ configuration line <code>include "/usr/share/nftables.avail/*.nft"</code> to ~~<code>~~/etc/nftables.nft~~</code>~~.		{{Tip\|On Alpine Linux Edge and from v3.23 onwards, all <code>-nftrules</code> that are available for your current installation, as well as for any future package to be installed, can be ''downloaded'' by installing {{Pkg\|nftables-rulesets}} from the main repo:
			{{Cmd\|# apk add nftables-rulesets}}
			}}
			These rules are '''''not''''' active upon package installation: they are only downloaded into that {{Path\|/usr/share/nftables.avail/}} directory. The user can then enable them, either by:
			* symlinking them individually to {{Path\|/etc/nftables.d/}}. For example, if there is the rule {{Path\|/usr/share/nftables.avail/sshd.nft}}, then issue the command below:{{Cmd\|# ln -s /usr/share/nftables.avail/sshd.nft /etc/nftables.d/sshd.nft}} or by
			* adding the configuration line <code>include "/usr/share/nftables.avail/*.nft"</code> into {{Path\|/etc/nftables.nft}}.

			==== Reloading rules ====

			The new ruleset can then be applied by simply ''reloading'' the service, or by rebooting. Reloading preserves the connections (the connection-tracking ''"conntrack"'' state), so it is preferable to ''restarting'' the service:
			{{Cmd\|# rc-service nftables reload}}
			or, alternatively, load the new ruleset with:
			{{Cmd\|# nft -f /etc/nftables.nft}}
			The '''nftables''' service is an init script that, when started or reloaded, runs once to load the rules and then exits. It is not a daemon, so it will not appear afterwards under {{ic\|# rc-status}}.

	== See also ==		== See also ==

	* [https://wiki.nftables.org/wiki-nftables/index.php/Main_Page nftables project Wiki]		* [https://wiki.nftables.org/wiki-nftables/index.php/Main_Page nftables project Wiki]
	* [https://wiki.archlinux.org/title/Nftables nftables ~~- ArchWiki~~]		* [https://wiki.archlinux.org/title/Nftables ArchWiki - nftables]
	* [[Uncomplicated Firewall]] Firewall program with higher level abstractions		* [[Uncomplicated Firewall]] - Firewall program with higher level abstractions
			* [[Tutorials_and_Howtos#Firewall\|Tutorials and Howtos - Firewall]]


	[[Category:Firewall]]		[[Category:Firewall]]

John3-16: /* Packaged rules */ Added instructions for new nftables-rulesets package

2025-12-31T05:14:32Z

Packaged rules: Added instructions for new nftables-rulesets package

← Older revision		Revision as of 05:14, 31 December 2025
Line 14:		Line 14:
	== Packaged rules ==		== Packaged rules ==

	Server software packages that are accompanied by an <code>-nftrules</code> package includes the typical default rules to expose the server. For example, {{pkg\|openssh-nftrules}} package will open the default port(s) used by {{pkg\|openssh}}. These rules are not active upon package installation. They are installed in the <code>/usr/share/nftables.avail/</code> directory. The user can either symlink them individually to <code>/etc/nftables.d/</code>, or add this configuration line <code>include "/usr/share/nftables.avail/*.nft"</code> to <code>/etc/nftables.nft</code>.		Server software packages that are accompanied by an <code>-nftrules</code> package includes the typical default rules to expose the server. For example, {{pkg\|openssh-nftrules}} package will open the default port(s) used by {{pkg\|openssh}}. On Alpine Linux Edge and from v3.23 onwards, all <code>-nftrules</code> that are available for your current installation, as well as for any future package to be installed, can be downloaded by installing {{Pkg\|nftables-rulesets}} on the main repo:
			{{Cmd\|$ doas apk add nftables-rulesets}}

			These rules are not active upon package installation. They are installed in the <code>/usr/share/nftables.avail/</code> directory. The user can either symlink them individually to <code>/etc/nftables.d/</code>, or add this configuration line <code>include "/usr/share/nftables.avail/*.nft"</code> to <code>/etc/nftables.nft</code>.

	== See also ==		== See also ==

StacyHarper: /* Packaged rules */

2025-08-20T06:11:11Z

Packaged rules

← Older revision		Revision as of 06:11, 20 August 2025
Line 14:		Line 14:
	== Packaged rules ==		== Packaged rules ==

	~~{{Issue\|16177\|This section describes a feature that are still being implemented and subject to change}}~~		Server software packages that are accompanied by an <code>-nftrules</code> package includes the typical default rules to expose the server. For example, {{pkg\|openssh-nftrules}} package will open the default port(s) used by {{pkg\|openssh}}. These rules are not active upon package installation. They are installed in the <code>/usr/share/nftables.avail/</code> directory. The user can either symlink them individually to <code>/etc/nftables.d/</code>, or add this configuration line <code>include "/usr/share/nftables.avail/*.nft"</code> to <code>/etc/nftables.nft</code>.

	Server software packages that are accompanied by an <code>-~~nftables~~</code> package includes the typical default rules to expose the server. For example, {{pkg\|~~kdeconnect~~-~~nftables~~}} package will open the default port(s) used by {{pkg\|~~kdeconnect~~}}. These rules are active upon package installation.

	== See also ==		== See also ==

Prabuanand: fixed typo

2025-08-05T07:04:52Z

fixed typo

← Older revision		Revision as of 07:04, 5 August 2025
Line 1:		Line 1:
	{{DISPLAYTITLE:nftables}}The ~~netfilter.org~~ [https://netfilter.org/projects/nftables nftables] project provides user-space tools to control the Linux nftables subsystem.		{{DISPLAYTITLE:nftables}}The [https://netfilter.org/projects/nftables nftables] project provides user-space tools to control the Linux nftables subsystem.

	== Installation ==		== Installation ==

Prabuanand: slight reordering to make things easier to follow

2025-08-05T06:14:47Z

slight reordering to make things easier to follow

← Older revision		Revision as of 06:14, 5 August 2025
Line 3:		Line 3:
	== Installation ==		== Installation ==

	To use {{Pkg\|nftables}} package, install it first:{{Cmd\|# apk add {{Pkg\|nftables}}}}		To use {{ic\|nft}} command from {{Pkg\|nftables}} package, install it first:{{Cmd\|# apk add {{Pkg\|nftables}}}}

	== Configuration ==		== Configuration ==
Line 9:		Line 9:
	The default <code>nftable</code> rules shipped will block all incoming connections. A service that loads the rules from {{path\|/etc/nftables.d}} folder can be enabled with: {{Cmd\|<nowiki># rc-update add nftables boot		The default <code>nftable</code> rules shipped will block all incoming connections. A service that loads the rules from {{path\|/etc/nftables.d}} folder can be enabled with: {{Cmd\|<nowiki># rc-update add nftables boot
	# rc-service nftables start</nowiki>}}		# rc-service nftables start</nowiki>}}

			If {{ic\|nftables}} rules are in {{Path\|/usr/share/nftables.avail}} folder, they must be symlinked to {{path\|/etc/nftables.d}} folder to enable them. For e.g if there is a rule {{Path\|/usr/share/nftables.avail/sshd.nft}}, issue the below command:{{Cmd\|# ln -s /usr/share/nftables.avail/sshd.nft /etc/nftables.d/sshd.nft}}

	== Packaged rules ==		== Packaged rules ==
Line 14:		Line 16:
	{{Issue\|16177\|This section describes a feature that are still being implemented and subject to change}}		{{Issue\|16177\|This section describes a feature that are still being implemented and subject to change}}

	Server software packages that are accompanied by an <code>-nftables</code> package includes the typical default rules to expose the server. For example, {{pkg\|kdeconnect-nftables}} package will open the default port(s) used by ~~<code>~~kdeconnect~~</code>~~. These rules are active upon package installation.		Server software packages that are accompanied by an <code>-nftables</code> package includes the typical default rules to expose the server. For example, {{pkg\|kdeconnect-nftables}} package will open the default port(s) used by {{pkg\|kdeconnect}}. These rules are active upon package installation.

	If {{ic\|nftables}} rules are in {{Path\|/usr/share/nftables.avail}} folder, they must be symlinked to {{path\|/etc/nftables.d}} folder to enable them. For e.g if there is a rule {{Path\|/usr/share/nftables.avail/sshd.nft}}, issue the below command:{{Cmd\|# ln -s /usr/share/nftables.avail/sshd.nft /etc/nftables.d/sshd.nft}}

	== See also ==		== See also ==

			* [https://wiki.nftables.org/wiki-nftables/index.php/Main_Page nftables project Wiki]
	* [https://wiki.archlinux.org/title/Nftables nftables - ArchWiki]		* [https://wiki.archlinux.org/title/Nftables nftables - ArchWiki]
	* [https://netfilter.org/projects/nftables/ nftables project homepage]
	* [[Uncomplicated Firewall]] Firewall program with higher level abstractions		* [[Uncomplicated Firewall]] Firewall program with higher level abstractions

	[[Category:Firewall]]		[[Category:Firewall]]

Prabuanand: updated page based on https://gitlab.alpinelinux.org/alpine/aports/-/issues/16177

2025-08-05T06:03:46Z

updated page based on https://gitlab.alpinelinux.org/alpine/aports/-/issues/16177

← Older revision		Revision as of 06:03, 5 August 2025
Line 1:		Line 1:
	{{DISPLAYTITLE:nftables}}The ~~{{Pkg\|~~nftables~~}} package~~ provides user-space tools to control the Linux nftables subsystem.		{{DISPLAYTITLE:nftables}}The netfilter.org [https://netfilter.org/projects/nftables nftables] project provides user-space tools to control the Linux nftables subsystem.

	~~A service that loads the rules from {{path\|/etc/nftables.d}} can be enabled with:~~		== Installation ==

	~~rc-update~~ add nftables ~~boot~~		To use {{Pkg\|nftables}} package, install it first:{{Cmd\|# apk add {{Pkg\|nftables}}}}
	~~rc-service nftables start~~

	~~The default rules shipped will block all incoming connections.~~		== Configuration ==

	~~= Packaged Rules =~~		The default <code>nftable</code> rules shipped will block all incoming connections. A service that loads the rules from {{path\|/etc/nftables.d}} folder can be enabled with: {{Cmd\|<nowiki># rc-update add nftables boot
			# rc-service nftables start</nowiki>}}

	~~{{Note\|This section describes a feature that are still being implemented and subject to change}}~~		== Packaged rules ==

	~~Many packages with server software~~ are ~~accompanied by an <code>-nftables</code> package which include the typical default rules~~ to ~~expose the server.~~		{{Issue\|16177\|This section describes a feature that are still being implemented and subject to change}}

	~~For example,~~ <code>~~openssh~~-nftables</code> will open the default port used by <code>~~openssh~~</code> ~~(i.e~~.~~: TCP port 22)~~.		Server software packages that are accompanied by an <code>-nftables</code> package includes the typical default rules to expose the server. For example, {{pkg\|kdeconnect-nftables}} package will open the default port(s) used by <code>kdeconnect</code>. These rules are active upon package installation.

	~~To enable these~~ rules, they must be symlinked ~~in <code>nftable<~~/~~code>'s configuration directory~~. E.g.:		If {{ic\|nftables}} rules are in {{Path\|/usr/share/nftables.avail}} folder, they must be symlinked to {{path\|/etc/nftables.d}} folder to enable them. For e.g if there is a rule {{Path\|/usr/share/nftables.avail/sshd.nft}}, issue the below command:{{Cmd\|# ln -s /usr/share/nftables.avail/sshd.nft /etc/nftables.d/sshd.nft}}

	~~<pre>~~		== See also ==
	~~ln -s /usr/share/nftables.avail/sshd.nft /etc/nftables.d/sshd.nft~~
	~~</pre>~~

	= See also =

	* [https://wiki.archlinux.org/title/Nftables nftables - ArchWiki]		* [https://wiki.archlinux.org/title/Nftables nftables - ArchWiki]
	* [https://netfilter.org/projects/nftables/ nftables project homepage]		* [https://netfilter.org/projects/nftables/ nftables project homepage]
	* [[Uncomplicated Firewall]]: Firewall program with higher level abstractions.		* [[Uncomplicated Firewall]] Firewall program with higher level abstractions

	[[Category:Firewall]]		[[Category:Firewall]]

Prabuanand: changed to :Category:Firewall

2025-04-09T11:22:36Z

changed to Category:Firewall

← Older revision		Revision as of 11:22, 9 April 2025
Line 28:		Line 28:
	* [[Uncomplicated Firewall]]: Firewall program with higher level abstractions.		* [[Uncomplicated Firewall]]: Firewall program with higher level abstractions.

	[[Category:~~Networking]][[Category:Security~~]]		[[Category:Firewall]]

Prabuanand: added :Category:Security

2025-01-10T05:48:19Z

added Category:Security

← Older revision		Revision as of 05:48, 10 January 2025
Line 28:		Line 28:
	* [[Uncomplicated Firewall]]: Firewall program with higher level abstractions.		* [[Uncomplicated Firewall]]: Firewall program with higher level abstractions.

	[[Category:Networking]]		[[Category:Networking]][[Category:Security]]

WhyNotHugo: /* Packaged Rules */ wording

2024-11-26T10:13:35Z

Packaged Rules: wording

← Older revision		Revision as of 10:13, 26 November 2024
Line 10:		Line 10:
	= Packaged Rules =		= Packaged Rules =

	{{Note\|This section describes ~~changes~~ that are still being implemented and subject to change}}		{{Note\|This section describes a feature that are still being implemented and subject to change}}

	Many packages with server software are accompanied by an <code>-nftables</code> package which include the typical default rules to expose the server.		Many packages with server software are accompanied by an <code>-nftables</code> package which include the typical default rules to expose the server.

← Older revision		Revision as of 00:21, 28 January 2026
Line 39:		Line 39:
	* [[Uncomplicated Firewall]] - Firewall program with higher level abstractions		* [[Uncomplicated Firewall]] - Firewall program with higher level abstractions
	* [[Tutorials_and_Howtos#Firewall\|Tutorials and Howtos - Firewall]]		* [[Tutorials_and_Howtos#Firewall\|Tutorials and Howtos - Firewall]]
			* [[Configure a Wireguard interface (wg)]]

	[[Category:Firewall]]		[[Category:Firewall]]