Nftables: Difference between revisions
Prabuanand (talk | contribs) (updated page based on https://gitlab.alpinelinux.org/alpine/aports/-/issues/16177) |
Prabuanand (talk | contribs) (slight reordering to make things easier to follow) |
||
| Line 3: | Line 3: | ||
== Installation == | == Installation == | ||
To use {{Pkg|nftables}} package, install it first:{{Cmd|# apk add {{Pkg|nftables}}}} | To use {{ic|nft}} command from {{Pkg|nftables}} package, install it first:{{Cmd|# apk add {{Pkg|nftables}}}} | ||
== Configuration == | == Configuration == | ||
| Line 9: | Line 9: | ||
The default <code>nftable</code> rules shipped will block all incoming connections. A service that loads the rules from {{path|/etc/nftables.d}} folder can be enabled with: {{Cmd|<nowiki># rc-update add nftables boot | The default <code>nftable</code> rules shipped will block all incoming connections. A service that loads the rules from {{path|/etc/nftables.d}} folder can be enabled with: {{Cmd|<nowiki># rc-update add nftables boot | ||
# rc-service nftables start</nowiki>}} | # rc-service nftables start</nowiki>}} | ||
If {{ic|nftables}} rules are in {{Path|/usr/share/nftables.avail}} folder, they must be symlinked to {{path|/etc/nftables.d}} folder to enable them. For e.g if there is a rule {{Path|/usr/share/nftables.avail/sshd.nft}}, issue the below command:{{Cmd|# ln -s /usr/share/nftables.avail/sshd.nft /etc/nftables.d/sshd.nft}} | |||
== Packaged rules == | == Packaged rules == | ||
| Line 14: | Line 16: | ||
{{Issue|16177|This section describes a feature that are still being implemented and subject to change}} | {{Issue|16177|This section describes a feature that are still being implemented and subject to change}} | ||
Server software packages that are accompanied by an <code>-nftables</code> package includes the typical default rules to expose the server. For example, {{pkg|kdeconnect-nftables}} package will open the default port(s) used by | Server software packages that are accompanied by an <code>-nftables</code> package includes the typical default rules to expose the server. For example, {{pkg|kdeconnect-nftables}} package will open the default port(s) used by {{pkg|kdeconnect}}. These rules are active upon package installation. | ||
== See also == | == See also == | ||
* [https://wiki.nftables.org/wiki-nftables/index.php/Main_Page nftables project Wiki] | |||
* [https://wiki.archlinux.org/title/Nftables nftables - ArchWiki] | * [https://wiki.archlinux.org/title/Nftables nftables - ArchWiki] | ||
* [[Uncomplicated Firewall]] Firewall program with higher level abstractions | * [[Uncomplicated Firewall]] Firewall program with higher level abstractions | ||
[[Category:Firewall]] | [[Category:Firewall]] | ||
Revision as of 06:14, 5 August 2025
The netfilter.org nftables project provides user-space tools to control the Linux nftables subsystem.
Installation
To use nft command from nftables package, install it first:
# apk add nftables
Configuration
The default nftable rules shipped will block all incoming connections. A service that loads the rules from /etc/nftables.d folder can be enabled with:
# rc-update add nftables boot # rc-service nftables start
If nftables rules are in /usr/share/nftables.avail folder, they must be symlinked to /etc/nftables.d folder to enable them. For e.g if there is a rule /usr/share/nftables.avail/sshd.nft, issue the below command:
# ln -s /usr/share/nftables.avail/sshd.nft /etc/nftables.d/sshd.nft
Packaged rules
#16177. This section describes a feature that are still being implemented and subject to change
Server software packages that are accompanied by an -nftables package includes the typical default rules to expose the server. For example, kdeconnect-nftables package will open the default port(s) used by kdeconnect. These rules are active upon package installation.
See also
- nftables project Wiki
- nftables - ArchWiki
- Uncomplicated Firewall Firewall program with higher level abstractions