nftables base ruleset

I have migrated to nftables. The iptables base ruleset^[1] was incredibly useful, each time I needed to setup from scratch. Following on from that, I wanted to bed down my nftables base ruleset too.

I picked up my iptables base ruleset^[1], and applied the migration techniques from the nftables wiki^[2].

On Gentoo, net-firewall/iptables needs nftables useflag for the translate utilities. These tools do not need superuser access.

The iptables service saves state to /var/lib/iptables/rules-save. It is not world readable.

Now we have the tool and the ruleset to translate.

$ iptables-restore-translate -f /var/lib/iptables/rules-save

Thus follows my current base ruleset.

#!/sbin/nft -f
flush ruleset
table filter {
 chain input {
  type filter hook input priority 0; policy drop;
  ct state invalid counter drop
  tcp flags != syn ct state new counter drop
  tcp flags & (fin|syn|rst|psh|ack|urg) == (fin|syn|rst|psh|ack|urg) counter drop
  tcp flags & (fin|syn|rst|psh|ack|urg) == (0x0) counter drop
  #ip frag-off != 0 counter log prefix "nft: " level notice drop
  iif lo ip saddr 127.0.0.1/8 accept
  ct state established,related accept
  counter log prefix "nfti: " level notice drop
 }
 chain output {
  type filter hook output priority 0; policy drop;
  ct state invalid counter drop
  oif lo ip daddr 127.0.0.1/8 accept
  ct state new,established accept
  counter log prefix "nfto: " level notice drop
 }
 chain forward {
  type filter hook forward priority 0; policy drop;
  counter log prefix "nft: " level notice drop
 }
}

Not all rules are successfully translated, or they don't work as I expected. I had to substantially verify and rewrite many translated rules.

For example, this is totally daft.

$ iptables-translate -A INPUT -p icmp --icmp-type any -j ACCEPT
nft add rule ip filter INPUT  counter accept
$ /sbin/iptables-translate -A output -p icmp --icmp-type any -j DROP
nft add rule ip filter output  counter drop

I had to comment off the following rule, which worked very well in iptables, but not in nftables. Please let me if you understand.

$ /sbin/iptables-translate -A INPUT -f -j DROP
nft add rule ip filter INPUT ip frag-off != 0 counter drop

My understanding is not complete, nor do I profess to be an expert. Please feedback.

---

[1] iptables base ruleset
[2] Moving from iptables to nftables