nftables

https://wiki.nftables.org/wiki-nftables/
Admin
nftables is a packet filtering framework for the Linux kernel, providing a powerful and flexible...
Tokens:286,933
Snippets:4,927
Trust Score:8.6
Update:11 months ago
Show doc for...
Tokens:
Raw
### Install nft Command-Line Utility from Git

Source: https://wiki.nftables.org/wiki-nftables/api_action=feedcontributions&feedformat=atom&user=AlexanderAlemayhu

This snippet guides through cloning the nftables repository from git, configuring, building, and installing the command-line utility. This provides the user interface for nftables.

```bash
% git clone git://git.netfilter.org/nftables
% cd nftables
% sh autogen.sh
% ./configure
% make
% make install
```

--------------------------------

### Install libnftnl from Snapshot

Source: https://wiki.nftables.org/wiki-nftables/api_action=feedcontributions&feedformat=atom&user=AlexanderAlemayhu

This snippet demonstrates downloading a libnftnl snapshot, extracting it, configuring, building, and installing the library. You will need wget and tar installed.

```bash
$ wget ftp://ftp.netfilter.org/pub/libnftnl/snapshot/libnftnl-20140217.tar.bz2
$ tar xvjf libnftnl-20140217.tar.bz2
$ ./configure
$ make
$ sudo make install
```

--------------------------------

### Install libnftnl from Git

Source: https://wiki.nftables.org/wiki-nftables/api_action=feedcontributions&feedformat=atom&user=AlexanderAlemayhu

This snippet shows how to clone the libnftnl repository from git, configure, build, and install it. Ensure you have git and build tools installed.

```bash
$ git clone git://git.netfilter.org/libnftnl
$ cd libnftnl
$ sh autogen.sh
$ ./configure
$ make
$ sudo make install
```

--------------------------------

### Configure Kernel for nftables Modules

Source: https://wiki.nftables.org/wiki-nftables/index_diff=cur&oldid=124&title=Building_and_installing_nftables_from_sources

Guides through configuring the Linux kernel to include necessary nftables modules. All nftables modules should be enabled ('m' or 'y') for proper functionality. This example shows a typical interactive configuration process.

```bash
make oldconfig

Netfilter Xtables support (required for ip_tables) (NETFILTER_XTABLES) [M/y/?] m
Netfilter nf_tables support (NF_TABLES) [N/m] (NEW) m
  Netfilter nf_tables payload module (NFT_PAYLOAD) [N/m] (NEW) m
  Netfilter nf_tables IPv6 exthdr module (NFT_EXTHDR) [N/m] (NEW) m
  Netfilter nf_tables meta module (NFT_META) [N/m] (NEW) m
  Netfilter nf_tables conntrack module (NFT_CT) [N/m] (NEW) m
  Netfilter nf_tables rbtree set module (NFT_RBTREE) [N/m] (NEW) m
  Netfilter nf_tables hash set module (NFT_HASH) [N/m] (NEW) m
  Netfilter nf_tables counter module (NFT_COUNTER) [N/m] (NEW) m
  Netfilter nf_tables log module (NFT_LOG) [N/m] (NEW) m
  Netfilter nf_tables limit module (NFT_LIMIT) [N/m] (NEW) m
  Netfilter nf_tables nat module (NFT_NAT) [N/m] (NEW) m
  Netfilter x_tables over nf_tables module (NFT_COMPAT) [N/m/?] (NEW) m

IPv4 nf_tables support (NF_TABLES_IPV4) [N/m] (NEW) m
  nf_tables IPv4 reject support (NFT_REJECT_IPV4) [N/m] (NEW) m
  IPv4 nf_tables route chain support (NFT_CHAIN_ROUTE_IPV4) [N/m] (NEW) m
  IPv4 nf_tables nat chain support (NFT_CHAIN_NAT_IPV4) [N/m] (NEW) m

IPv6 nf_tables support (NF_TABLES_IPV6) [M/n] m
  IPv6 nf_tables route chain support (NFT_CHAIN_ROUTE_IPV6) [M/n] m
  IPv6 nf_tables nat chain support (NFT_CHAIN_NAT_IPV6) [M/n] m

Ethernet Bridge nf_tables support (NF_TABLES_BRIDGE) [N/m/y] (NEW) m

```

--------------------------------

### Install nftables Command-Line Utility from Git - Shell Commands

Source: https://wiki.nftables.org/wiki-nftables/index_diff=next&oldid=126&title=Building_and_installing_nftables_from_sources

These shell commands guide users through cloning the nftables repository, setting up the build environment, configuring, compiling, and installing the nft command-line utility. This is the recommended method for obtaining the latest version.

```shell
% git clone git://git.netfilter.org/nftables
% cd nftables
% sh autogen.sh
% ./configure
% make
% make install

```

--------------------------------

### Check nftables Kernel Configuration Options (Debian Example)

Source: https://wiki.nftables.org/wiki-nftables/index_oldid=126&title=Building_and_installing_nftables_from_sources

This command shows how to inspect the kernel configuration file on a Debian system to check which nftables-related features are compiled into the kernel. This helps in understanding the capabilities and limitations of the current nftables setup.

```bash
%grep CONFIG_NFT_ /boot/config-4.2.0-1-amd64
CONFIG_NFT_EXTHDR=m
CONFIG_NFT_META=m
CONFIG_NFT_CT=m
CONFIG_NFT_RBTREE=m
CONFIG_NFT_HASH=m
CONFIG_NFT_COUNTER=m
CONFIG_NFT_LOG=m
CONFIG_NFT_LIMIT=m
CONFIG_NFT_MASQ=m
CONFIG_NFT_REDIR=m
CONFIG_NFT_NAT=m
CONFIG_NFT_QUEUE=m
CONFIG_NFT_REJECT=m
CONFIG_NFT_REJECT_INET=m
CONFIG_NFT_COMPAT=m
CONFIG_NFT_CHAIN_ROUTE_IPV4=m
CONFIG_NFT_REJECT_IPV4=m
CONFIG_NFT_CHAIN_NAT_IPV4=m
CONFIG_NFT_MASQ_IPV4=m
```

--------------------------------

### Configure Kernel for nftables Modules (Example)

Source: https://wiki.nftables.org/wiki-nftables/index_oldid=126&title=Building_and_installing_nftables_from_sources

Example output from the 'make oldconfig' command during kernel configuration, showing how to enable various nftables modules. Modules are typically built as loadable kernel modules ('m').

```text
Netfilter Xtables support (required for ip_tables) (NETFILTER_XTABLES) [M/y/?] m
Netfilter nf_tables support (NF_TABLES) [N/m] (NEW) m
  Netfilter nf_tables payload module (NFT_PAYLOAD) [N/m] (NEW) m
  Netfilter nf_tables IPv6 exthdr module (NFT_EXTHDR) [N/m] (NEW) m
  Netfilter nf_tables meta module (NFT_META) [N/m] (NEW) m
  Netfilter nf_tables conntrack module (NFT_CT) [N/m] (NEW) m
  Netfilter nf_tables rbtree set module (NFT_RBTREE) [N/m] (NEW) m
  Netfilter nf_tables hash set module (NFT_HASH) [N/m] (NEW) m
  Netfilter nf_tables counter module (NFT_COUNTER) [N/m] (NEW) m
  Netfilter nf_tables log module (NFT_LOG) [N/m] (NEW) m
  Netfilter nf_tables limit module (NFT_LIMIT) [N/m] (NEW) m
  Netfilter nf_tables nat module (NFT_NAT) [N/m] (NEW) m
  Netfilter x_tables over nf_tables module (NFT_COMPAT) [N/m/?] (NEW) m

IPv4 nf_tables support (NF_TABLES_IPV4) [N/m] (NEW) m
  nf_tables IPv4 reject support (NFT_REJECT_IPV4) [N/m] (NEW) m
  IPv4 nf_tables route chain support (NFT_CHAIN_ROUTE_IPV4) [N/m] (NEW) m
  IPv4 nf_tables nat chain support (NFT_CHAIN_NAT_IPV4) [N/m] (NEW) m

IPv6 nf_tables support (NF_TABLES_IPV6) [M/n] m
  IPv6 nf_tables route chain support (NFT_CHAIN_ROUTE_IPV6) [M/n] m
  IPv6 nf_tables nat chain support (NFT_CHAIN_NAT_IPV6) [M/n] m

Ethernet Bridge nf_tables support (NF_TABLES_BRIDGE) [N/m/y] (NEW) m
```

--------------------------------

### Build and Install libnftnl Dependency

Source: https://wiki.nftables.org/wiki-nftables/index.php/Portal%3ADeveloperDocs/Development_environment

This sequence of commands builds and installs the libnftnl library, a dependency for nftables. It assumes the source code has been cloned. The process includes generating build scripts, configuring the build, compiling, and installing the library, typically to /usr/local/.

```bash
./autogen.sh && ./configure && make -j8 && sudo make install
```

--------------------------------

### Configure Linux Kernel for nftables Modules

Source: https://wiki.nftables.org/wiki-nftables/index_action=edit&oldid=126&title=Building_and_installing_nftables_from_sources

This example shows the interactive process of configuring the Linux kernel, specifically focusing on enabling various nftables modules. It demonstrates the expected prompts and choices for building nftables support.

```bash
$ make oldconfig
Netfilter Xtables support (required for ip_tables) (NETFILTER_XTABLES) [M/y/?] m
Netfilter nf_tables support (NF_TABLES) [N/m] (NEW) m
Netfilter nf_tables payload module (NFT_PAYLOAD) [N/m] (NEW) m
Netfilter nf_tables IPv6 exthdr module (NFT_EXTHDR) [N/m] (NEW) m
Netfilter nf_tables meta module (NFT_META) [N/m] (NEW) m
Netfilter nf_tables conntrack module (NFT_CT) [N/m] (NEW) m
Netfilter nf_tables rbtree set module (NFT_RBTREE) [N/m] (NEW) m
Netfilter nf_tables hash set module (NFT_HASH) [N/m] (NEW) m
Netfilter nf_tables counter module (NFT_COUNTER) [N/m] (NEW) m
Netfilter nf_tables log module (NFT_LOG) [N/m] (NEW) m
Netfilter nf_tables limit module (NFT_LIMIT) [N/m] (NEW) m
Netfilter nf_tables nat module (NFT_NAT) [N/m] (NEW) m
Netfilter x_tables over nf_tables module (NFT_COMPAT) [N/m/?] (NEW) m
IPv4 nf_tables support (NF_TABLES_IPV4) [N/m] (NEW) m
IPv4 nf_tables reject support (NFT_REJECT_IPV4) [N/m] (NEW) m
IPv4 nf_tables route chain support (NFT_CHAIN_ROUTE_IPV4) [N/m] (NEW) m
IPv4 nf_tables nat chain support (NFT_CHAIN_NAT_IPV4) [N/m] (NEW) m
IPv6 nf_tables support (NF_TABLES_IPV6) [M/n] m
IPv6 nf_tables route chain support (NFT_CHAIN_ROUTE_IPV6) [M/n] m
IPv6 nf_tables nat chain support (NFT_CHAIN_NAT_IPV6) [M/n] m
Ethernet Bridge nf_tables support (NF_TABLES_BRIDGE) [N/m/y] (NEW) m
```

--------------------------------

### Install nftables Command-Line Utility from Git

Source: https://wiki.nftables.org/wiki-nftables/index_action=edit&oldid=127&title=Building_and_installing_nftables_from_sources

This sequence of commands clones the nftables repository from git, changes the directory, generates build scripts, configures the build, and installs the 'nft' command-line utility. This requires git to be installed.

```bash
git clone git://git.netfilter.org/nftables
cd nftables
sh autogen.sh
./configure
make
make install
```

--------------------------------

### Complete Nftables Ruleset with Tracing Example (Bash)

Source: https://wiki.nftables.org/wiki-nftables/api_action=feedcontributions&feedformat=atom&user=Admin

This comprehensive example illustrates the setup of a basic nftables ruleset, the addition of a trace chain, enabling tracing for specific packets, and then monitoring the trace output. It covers creating a table, chains, and rules, and demonstrates a practical test case using ping.

```bash
% cat ruleset.nft
table ip filter {
chain input {
type filter hook input priority filter; policy drop;
ct state established,related counter packets 2 bytes 292 accept
ct state new tcp dport 22 counter packets 0 bytes 0 accept
}
}
% nft -f ruleset.nft
```

```bash
% nft add chain ip filter trace_chain { type filter hook prerouting priority -600\; }
```

```bash
% nft add rule ip filter trace_chain meta nftrace set 1
```

```bash
% ping -c 1 8.8.8.8
```

```bash
% nft monitor trace
trace id a95ea7ef ip filter trace_chain packet: iif "enp0s25" ether saddr 00:0d:b9:4a:49:3d ether daddr 3c:97:0e:39:dd:20 ip saddr 8.8.8.8 ip daddr 192.168.2.118 ip dscp cs0 ip ecn not-ect ip ttl 115 ip id 0 ip length 84 icmp type echo-reply icmp code net-unreachable icmp id 9253 icmp sequence 1 @th,64,96 24106705117628271805883024640 <br /> trace id a95ea7ef ip filter trace_chain rule meta nftrace set 1 (verdict continue)<br /> trace id a95ea7ef ip filter trace_chain verdict continue <br /> trace id a95ea7ef ip filter input packet: iif "enp0s25" ether saddr 00:0d:b9:4a:49:3d ether daddr 3c:97:0e:39:dd:20 ip saddr 8.8.8.8 ip daddr 192.168.2.118 ip dscp cs0 ip ecn not-ect ip ttl 115 ip id 0 ip length 84 icmp type echo-reply icmp code net-unreachable icmp id 9253 icmp sequence 1 @th,64,96 24106705117628271805883024640 <br /> trace id a95ea7ef ip filter input rule ct state established,related counter packets 168 bytes 53513 accept (verdict accept)<br />
```

--------------------------------

### Install nftables command-line utility from Git - Shell

Source: https://wiki.nftables.org/wiki-nftables/index_oldid=498&title=Building_and_installing_nftables_from_sources

This code block demonstrates how to clone the nftables repository from git, change to the nftables directory, generate the build scripts, configure the build process, compile the utility, and install it system-wide using make and sudo. This is the recommended method for developers.

```shell
%git clone git://git.netfilter.org/nftables
%cd nftables
%sh autogen.sh
./configure
%make
%make install

```

--------------------------------

### Install libnftnl from snapshot

Source: https://wiki.nftables.org/wiki-nftables/index_diff=cur&oldid=498&title=Building_and_installing_nftables_from_sources

Installs the libnftnl userspace library from a daily snapshot archive. This method is an alternative to cloning from git.

```bash
$ wget ftp://ftp.netfilter.org/pub/libnftnl/snapshot/libnftnl-20140217.tar.bz2
$ tar xvjf libnftnl-20140217.tar.bz2
$ ./configure
$ make
$ sudo make install

```

--------------------------------

### Verify nft Command Installation

Source: https://wiki.nftables.org/wiki-nftables/api_action=feedcontributions&feedformat=atom&user=AlexanderAlemayhu

After installing the 'nft' command-line utility, this snippet shows how to verify its installation by running the 'nft' command without any arguments. A specific output indicates a successful installation.

```bash
% nft
nft: no command specified
```

--------------------------------

### Install libnftnl from Git

Source: https://wiki.nftables.org/wiki-nftables/index.php/Building_and_installing_nftables_from_sources

Clones the libnftnl repository from git, builds, and installs it. This method is recommended for testing git snapshots. Ensure you have git installed. The installation process involves standard configure, make, and make install steps. It may require root privileges for the final installation.

```shell
git clone git://git.netfilter.org/libnftnl
cd libnftnl
sh autogen.sh
./configure
make
sudo make install
```

--------------------------------

### Example Nftables Table and Chain Configuration (inet family)

Source: https://wiki.nftables.org/wiki-nftables/index_diff=1151&oldid=702&title=Configuring_chains

Shows an example Nftables table setup for the 'inet' family, featuring a 'filter' table and a 'services' chain. This example demonstrates the structure for defining tables and chains, along with comments on priority and default policies.

```nftables
table inet filter {
 # This chain is evaluated first due to priority
 chain services {
 }
}
# NOTE: If no policy is explicitly selected, the default policy "accept" will be used.
```

--------------------------------

### Verify nft Command-Line Utility Installation

Source: https://wiki.nftables.org/wiki-nftables/index_action=edit&oldid=61&title=Building_and_installing_nftables_from_sources

This snippet shows how to execute the 'nft' command without any arguments to verify its installation. A correct installation will output 'nft: no command specified'.

```bash
nft
ft: no command specified
```

--------------------------------

### Install nftables from Source - Command Line

Source: https://wiki.nftables.org/wiki-nftables/index_diff=cur&oldid=9&title=Building_and_installing_nftables_from_sources

This command executes the installation process for nftables after it has been compiled from source. It requires root privileges and is typically run after a successful `make` command. Ensure all dependencies are met before execution.

```bash
sudo make install
```

--------------------------------

### Check Kernel Configuration for nftables Support (Debian Example)

Source: https://wiki.nftables.org/wiki-nftables/index_action=edit&title=Building_and_installing_nftables_from_sources

This command searches the Debian kernel configuration file for lines related to nftables features. It helps determine which specific nftables functionalities are compiled into the kernel.

```bash
grep CONFIG_NFT_ /boot/config-4.2.0-1-amd64
```

--------------------------------

### Install libnftnl from Snapshots

Source: https://wiki.nftables.org/wiki-nftables/index.php/Building_and_installing_nftables_from_sources

Downloads a daily snapshot of libnftnl, extracts it, and installs it. This method is an alternative if direct git cloning is not possible. It involves using wget to download the archive, tar to extract it, and then the standard configure, make, and make install process. Root privileges might be needed for installation.

```shell
wget ftp://ftp.netfilter.org/pub/libnftnl/snapshot/libnftnl-20140217.tar.bz2
tar xvjf libnftnl-20140217.tar.bz2
./configure
make
sudo make install
```

--------------------------------

### Example nftables ruleset for tracing

Source: https://wiki.nftables.org/wiki-nftables/api_action=feedcontributions&feedformat=atom&user=Admin

This example demonstrates a complete setup for nftables tracing. It includes defining a basic IP filter table with an input chain, adding a dedicated chain for tracing, and then enabling tracing for packets hitting that chain. Finally, it shows how to test tracing by pinging a host and monitoring the output.

```bash
% cat ruleset.nft
table ip filter {
chain input {
type filter hook input priority filter; policy drop;
ct state established,related counter packets 2 bytes 292 accept
ct state new tcp dport 22 counter packets 0 bytes 0 accept
}
}
% nft -f ruleset.nft
% nft add chain ip filter trace_chain { type filter hook prerouting priority -600\; }
% nft add rule ip filter trace_chain meta nftrace set 1
% ping -c 1 8.8.8.8
% nft monitor trace
```

--------------------------------

### Install nftables from Source (Bash)

Source: https://wiki.nftables.org/wiki-nftables/index_diff=cur&oldid=124&title=Building_and_installing_nftables_from_sources

This command installs nftables after compiling from source. Ensure all dependencies like libmnl, libnftnl, libgmp, and libreadline are installed with their development packages.

```bash
$ sudo make install
```

--------------------------------

### Clone nftables repository using git

Source: https://wiki.nftables.org/wiki-nftables/index_diff=cur&oldid=498&title=Building_and_installing_nftables_from_sources

Clones the nftables source code repository from the official git URL. This is the initial step for installing nftables from its development version.

```bash
$ git clone git://git.netfilter.org/nftables
% cd nftables
% sh autogen.sh
% ./configure
% make
% sudo make install

```

--------------------------------

### Install libnftnl from git

Source: https://wiki.nftables.org/wiki-nftables/index_diff=cur&oldid=498&title=Building_and_installing_nftables_from_sources

Installs the libnftnl userspace library from its git repository. This library provides the low-level API for Netlink message transformation.

```bash
$ git clone git://git.netfilter.org/libnftnl
$ cd libnftnl
$ sh autogen.sh
$ ./configure
$ make
$ sudo make install

```

--------------------------------

### Verify nft Command-Line Utility Installation

Source: https://wiki.nftables.org/wiki-nftables/index_action=edit&oldid=129&title=Building_and_installing_nftables_from_sources

Verifies that the nft command-line utility has been successfully installed by running the 'nft' command without any arguments. A 'no command specified' output indicates success.

```bash
nft
nft: no command specified
```

--------------------------------

### Install nft command-line utility from Git

Source: https://wiki.nftables.org/wiki-nftables/index.php/Building_and_installing_nftables_from_sources

Clones the nftables repository from git, builds, and installs the nft command-line utility. This utility provides the user interface for configuring nftables. The process involves cloning the repository, running autogen.sh, configure, make, and make install. Root privileges are typically required for the installation step.

```shell
%git clone git://git.netfilter.org/nftables
%cd nftables
%sh autogen.sh
%./configure
%make
%make install
```

--------------------------------

### Verify nft Command-Line Utility Installation

Source: https://wiki.nftables.org/wiki-nftables/index_action=edit&title=Building_and_installing_nftables_from_sources

This simple command execution verifies if the 'nft' command-line utility has been successfully installed and is accessible in the system's PATH. A specific output indicates successful installation.

```bash
nft
```

--------------------------------

### Check nft Kernel Configuration (Debian Example)

Source: https://wiki.nftables.org/wiki-nftables/index_action=edit&oldid=501&title=Building_and_installing_nftables_from_sources

Checks the kernel configuration file on Debian-based systems to determine if specific nftables features, like redirect support for IPv4 and IPv6, are enabled. This helps in understanding limitations of the current kernel build.

```bash
% grep CONFIG_NFT_ /boot/config-4.2.0-1-amd64
CONFIG_NFT_EXTHDR=m
CONFIG_NFT_META=m
CONFI
```

--------------------------------

### View Kernel Configuration for nftables Modules (Debian/Ubuntu)

Source: https://wiki.nftables.org/wiki-nftables/index_diff=next&oldid=128&title=Building_and_installing_nftables_from_sources

This command searches the kernel configuration file for entries related to nftables modules. It is useful for determining which nftables features are compiled into the kernel or available as modules, as shown in the Debian example.

```bash
% grep CONFIG_NFT_ /boot/config-4.2.0-1-amd64
```

--------------------------------

### Verify nft Command-Line Utility Installation

Source: https://wiki.nftables.org/wiki-nftables/api_action=feedcontributions&feedformat=atom&user=AlexanderAlemayhu

After installing the nft command-line utility, you can verify its successful installation by running the 'nft' command. A 'no command specified' output indicates success.

```bash
% nft
ft: no command specified
```

--------------------------------

### Install nft command-line utility and validate - Shell

Source: https://wiki.nftables.org/wiki-nftables/index_diff=next&oldid=125&title=Building_and_installing_nftables_from_sources

Installs the nft command-line utility and then validates the installation by running the 'nft' command without arguments, which should output 'nft: no command specified'.

```shell
% git clone git://git.netfilter.org/nftables
% cd nftables
% sh autogen.sh
% ./configure
% make
% sudo make install

% nft
ft: no command specified
```

--------------------------------

### Check nftables Kernel Module Loading Message

Source: https://wiki.nftables.org/wiki-nftables/index_oldid=126&title=Building_and_installing_nftables_from_sources

This example demonstrates how to view the kernel log messages using dmesg to confirm that the 'nf_tables' module has been loaded successfully. The expected output indicates the module's origin and version.

```bash
%dmesg
...[13939.468020] nf_tables: (c) 2007-2009 Patrick McHardy <kaber@trash.net>
```

--------------------------------

### Nftables Shell Command Example

Source: https://wiki.nftables.org/wiki-nftables/index_diff=1151&oldid=1146&title=Configuring_chains

This snippet demonstrates a valid shell command for interacting with nftables. It's designed to be directly executable in a shell environment like bash. Ensure nftables is installed and configured.

```shell
#!/bin/sh
ft add table ip filter
ft add chain ip filter input { type filter hook input priority filter; policy accept; }
ft add chain ip filter output { type filter hook output priority filter; policy accept; }
```

--------------------------------

### nftables Comments and Basic Ruleset

Source: https://wiki.nftables.org/wiki-nftables/index_diff=prev&oldid=1077&title=Scripting

Demonstrates how to add comments and define basic nftables structures like tables, chains, and rules. Comments, starting with '#', are ignored by the interpreter, aiding in ruleset readability and organization. This example includes a table, an input chain with a 'drop' policy, and a rule to accept established/related connections.

```nftables
#!/usr/sbin/nft -f

#
table declaration
#
add table filter

#
chain declaration
#
add chain filter input { type filter hook input priority 0; policy drop; }

#
rule declaration
#
add rule filter input ct state established,related counter accept
```

--------------------------------

### Install and Verify nf_tables Kernel Module

Source: https://wiki.nftables.org/wiki-nftables/index_diff=prev&oldid=125&title=Building_and_installing_nftables_from_sources

Demonstrates how to load the 'nf_tables' kernel module using 'modprobe' and verify its presence using 'lsmod'. It also shows how to check dmesg for confirmation and load family support modules like 'nf_tables_ipv4'.

```bash
% modprobe nf_tables

```

```bash
# lsmod | grep nf_tables
nf_tables              42349  0

```

```bash
% dmesg
...  
[13939.468020] nf_tables: (c) 2007-2009 Patrick McHardy <kaber@trash.net>

```

```bash
% modprobe nf_tables_ipv4

```

--------------------------------

### Complete nftables Tracing Example (Bash)

Source: https://wiki.nftables.org/wiki-nftables/api_action=feedcontributions&feedformat=atom&user=Admin

This comprehensive example illustrates the entire process of setting up nftables tracing. It includes defining a sample ruleset, loading it, creating a trace chain, adding a rule to enable tracing, and then demonstrates how to trigger tracing with a ping command and monitor the events.

```bash
table ip filter {
chain input {
type filter hook input priority filter; policy drop;
ct state established,related counter packets 2 bytes 292 accept
ct state new tcp dport 22 counter packets 0 bytes 0 accept
}
}

```

```bash
% nft -f ruleset.nft
```

```bash
% nft add chain ip filter trace_chain { type filter hook prerouting priority -600; }
```

```bash
% nft add rule ip filter trace_chain meta nftrace set 1
```

```bash
% ping -c 1 8.8.8.8
```

```bash
% nft monitor trace
```

--------------------------------

### Simple nftables tracing example - Bash

Source: https://wiki.nftables.org/wiki-nftables/api_action=feedcontributions&feedformat=atom&user=Admin

Demonstrates a basic nftables tracing setup. It adds a rule to set nftrace to 1 for packets entering the filter input chain on the loopback interface and then monitors the trace output.

```bash
% nft add rule inet filter input iif lo counter nftrace set 1 accept
% nft monitor trace
trace id 530fa6dd inet filter input packet: iif lo 
trace id 530fa6dd inet filter input rule iif lo accept (verdict accept)
trace id 87a375ea inet filter input packet: iif lo 
trace id 87a375ea inet filter input rule iif lo accept (verdict accept)
```

--------------------------------

### Complete nftables tracing example

Source: https://wiki.nftables.org/wiki-nftables/api_action=feedcontributions&feedformat=atom&user=Admin

This comprehensive example demonstrates the full workflow of setting up and using nftables tracing. It includes loading a basic ruleset, adding a trace chain and rule, simulating traffic with a ping command, and then monitoring the generated trace output.

```bash
table ip filter {
chain input {
type filter hook input priority filter; policy drop;
ct state established,related counter packets 2 bytes 292 accept
ct state new tcp dport 22 counter packets 0 bytes 0 accept
}
}
```

```bash
% nft -f ruleset.nft
```

```bash
% nft add chain ip filter trace_chain { type filter hook prerouting priority -600\; }
```

```bash
% nft add rule ip filter trace_chain meta nftrace set 1
```

```bash
% ping -c 1 8.8.8.8
```

```bash
% nft monitor trace
```

--------------------------------

### Complete nftrace example with accept

Source: https://wiki.nftables.org/wiki-nftables/api_action=feedcontributions&feedformat=atom&user=Admin

A full example demonstrating how to add a rule that enables nftrace and accepts the packet, then monitoring the trace output. This helps visualize the tracing process.

```bash
% nft add rule inet filter input iif lo counter nftrace set 1 accept
% nft monitor trace
```

--------------------------------

### Nftables Table Structure Example

Source: https://wiki.nftables.org/wiki-nftables/index_diff=1151&oldid=1140&title=Configuring_chains

This is an example of a basic nftables table structure, defining a table named 'filter' with a chain named 'services'. This chain is evaluated first due to its priority, indicating a common setup for initial packet processing.

```nftables
table ip filter {
  # This chain is evaluated first due to priority
  chain services {

```

--------------------------------

### Nftables Connection Tracking (ct) Helper Match Examples

Source: https://wiki.nftables.org/wiki-nftables/index_diff=prev&oldid=1096&title=Quick_reference-nftables_in_10_minutes

Examples for matching the helper module associated with a connection using the ct extension in nftables. This is useful for protocols that require specific helper modules.

```nftables
ct helper "ftp"
```

--------------------------------

### Complete Nftables Tracing Example

Source: https://wiki.nftables.org/wiki-nftables/api_action=feedcontributions&feedformat=atom&user=Admin

This comprehensive example illustrates the entire process of setting up packet tracing in nftables, from defining a ruleset to enabling tracing and monitoring the output. It includes creating a chain, adding a rule, and simulating traffic.

```bash
table ip filter {
chain input {
type filter hook input priority filter; policy drop;
ct state established,related counter packets 2 bytes 292 accept
ct state new tcp dport 22 counter packets 0 bytes 0 accept
}
}

% nft -f ruleset.nft
% nft add chain ip filter trace_chain { type filter hook prerouting priority -600\; }
% nft add rule ip filter trace_chain meta nftrace set 1

% ping -c 1 8.8.8.8

% nft monitor trace
trace id a95ea7ef ip filter trace_chain packet: iif "enp0s25" ether saddr 00:0d:b9:4a:49:3d ether daddr 3c:97:0e:39:aa:20 ip saddr 8.8.8.8 ip daddr 192.168.2.118 ip dscp cs0 ip ecn not-ect ip ttl 115 ip id 0 ip length 84 icmp type echo-reply icmp code net-unreachable icmp id 9253 icmp sequence 1 @th,64,96 24106705117628271805883024640 
trace id a95ea7ef ip filter trace_chain rule meta nftrace set 1 (verdict continue)
trace id a95ea7ef ip filter trace_chain verdict continue 
trace id a95ea7ef ip filter input packet: iif "enp0s25" ether saddr 00:0d:b9:4a:49:3d ether daddr 3c:97:0e:39:aa:20 ip saddr 8.8.8.8 ip daddr 192.168.2.118 ip dscp cs0 ip ecn not-ect ip ttl 115 ip id 0 ip length 84 icmp type echo-reply icmp code net-unreachable icmp id 9253 icmp sequence 1 @th,64,96 24106705117628271805883024640 
trace id a95ea7ef ip filter input rule ct state established,related counter packets 168 bytes 53513 accept (verdict accept)
```

--------------------------------

### Install nft Command-Line Utility from Git

Source: https://wiki.nftables.org/wiki-nftables/api_action=feedcontributions&feedformat=atom&user=Admin

Installs the nft command-line utility for configuring nftables by cloning the official git repository, configuring the build, compiling, and installing the utility. A verification step ensures the command is available.

```bash
% git clone git://git.netfilter.org/nftables
% cd nftables
% sh autogen.sh
% ./configure
% make
% make install
```

```bash
% nft
nft: no command specified
```

--------------------------------

### Using nftables from Python with libnftables

Source: https://wiki.nftables.org/wiki-nftables/index_diff=prev&oldid=1077&title=Scripting

This snippet is a placeholder for Python code demonstrating how to interact with nftables using the libnftables library. The library provides a high-level interface equivalent to the 'nft' command-line utility. Actual code examples would be found in the linked tutorials.

```python
# Example placeholder for Python code using libnftables
# import libnftables
# ... actual code would go here ...

```

--------------------------------

### Validate nf_tables Kernel Module - Shell

Source: https://wiki.nftables.org/wiki-nftables/index_diff=prev&oldid=127&title=Building_and_installing_nftables_from_sources

This snippet shows how to load the 'nf_tables' kernel module using 'modprobe' and then verify its presence using 'lsmod'. It also includes an example of the expected output from 'dmesg' after loading the module, confirming the nftables kernel support. This is typically run on a Linux system.

```shell
% modprobe nf_tables
# lsmod | grep nf_tables
nf_tables              42349  0
% dmesg
...[13939.468020] nf_tables: (c) 2007-2009 Patrick McHardy <kaber@trash.net>
```

--------------------------------

### Puppet: Install and Configure Basic Nftables Ruleset

Source: https://wiki.nftables.org/wiki-nftables/index_action=edit&title=Using_configuration_management_systems

This Puppet module installs the nftables package, creates a directory for configuration, deploys a basic nftables ruleset skeleton, and ensures the nftables service is running. It relies on a source file for the nftables configuration.

```puppet
class nftables( ) {
  # install the package
  package {
    'nftables':
      ensure => 'present',
  }

  # create a directory to hold the nftables config file
  file {
    '/etc/nftables/':
      ensure => 'directory',
  }

  # deploy the basic configuration file, i.e, the basic nftables ruleset skeleton
  file {
    '/etc/nftables/ruleset.nft':
      ensure => 'present',
      source => 'puppet:///modules/nftables/nftables.nft',
  }

  # ensure nftables systemd service is running (at boot time, etc)
  service {
    'nftables':
      ensure => 'running',
  }
}
```

--------------------------------

### Validate nftables Kernel Module Installation

Source: https://wiki.nftables.org/wiki-nftables/index_diff=next&oldid=128&title=Building_and_installing_nftables_from_sources

Demonstrates how to load the 'nf_tables' kernel module using modprobe and verify its presence with lsmod. It also shows how to check dmesg output for confirmation and load family support modules like nf_tables_ipv4.

```bash
% modprobe nf_tables
# lsmod | grep nf_tables
nf_tables              42349  0
% dmesg
... (output showing nf_tables module loaded)
% modprobe nf_tables_ipv4
```

--------------------------------

### Load and Verify nf_tables Kernel Module

Source: https://wiki.nftables.org/wiki-nftables/api_action=feedcontributions&feedformat=atom&user=AlexanderAlemayhu

This demonstrates how to load the 'nf_tables' kernel module using 'modprobe' and then verify its presence using 'lsmod'. It also shows how to check dmesg for confirmation messages.

```bash
% modprobe nf_tables
# lsmod | grep nf_tables
nf_tables 42349 0
% dmesg
... 
[13939.468020] nf_tables: (c) 2007-2009 Patrick McHardy <kaber@trash.net>
```

--------------------------------

### Clone Netfilter Project Source Code with Git

Source: https://wiki.nftables.org/wiki-nftables/index.php/Portal%3ADeveloperDocs/Development_environment

This command uses git to clone the source code repositories for Netfilter projects, such as libnftnl and nftables. Ensure you have git installed. The cloned code will be used for building and development.

```bash
git clone http://git.netfilter.org/
```

--------------------------------

### Configure Kernel for Nftables Modules

Source: https://wiki.nftables.org/wiki-nftables/index_action=edit&oldid=125&title=Building_and_installing_nftables_from_sources

This section demonstrates the `make oldconfig` process for enabling nftables kernel modules. It shows examples of configuring various nftables features, such as NAT, payload, and IPv4/IPv6 support, by selecting 'm' for module or 'y' for built-in.

```bash
$ make oldconfig
Netfilter Xtables support (required for ip_tables) (NETFILTER_XTABLES) [M/y/?] m
Netfilter nf_tables support (NF_TABLES) [N/m] (NEW) m
Netfilter nf_tables payload module (NFT_PAYLOAD) [N/m] (NEW) m
Netfilter nf_tables IPv6 exthdr module (NFT_EXTHDR) [N/m] (NEW) m
Netfilter nf_tables meta module (NFT_META) [N/m] (NEW) m
Netfilter nf_tables conntrack module (NFT_CT) [N/m] (NEW) m
Netfilter nf_tables rbtree set module (NFT_RBTREE) [N/m] (NEW) m
Netfilter nf_tables hash set module (NFT_HASH) [N/m] (NEW) m
Netfilter nf_tables counter module (NFT_COUNTER) [N/m] (NEW) m
Netfilter nf_tables log module (NFT_LOG) [N/m] (NEW) m
Netfilter nf_tables limit module (NFT_LIMIT) [N/m] (NEW) m
Netfilter nf_tables nat module (NFT_NAT) [N/m] (NEW) m
Netfilter x_tables over nf_tables module (NFT_COMPAT) [N/m/?] (NEW) m
IPv4 nf_tables support (NF_TABLES_IPV4) [N/m] (NEW) m
 $$
 nf_tables IPv4 reject support (NFT_REJECT_IPV4) [N/m] (NEW) m
 IPv4 nf_tables route chain support (NFT_CHAIN_ROUTE_IPV4) [N/m] (NEW) m
 IPv4 nf_tables nat chain support (NFT_CHAIN_NAT_IPV4) [N/m] (NEW) m
 IPv6 nf_tables support (NF_TABLES_IPV6) [M/n] m
 IPv6 nf_tables route chain support (NFT_CHAIN_ROUTE_IPV6) [M/n] m
 IPv6 nf_tables nat chain support (NFT_CHAIN_NAT_IPV6) [M/n] m
 Ethernet Bridge nf_tables support (NF_TABLES_BRIDGE) [N/m/y] (NEW) m
```

--------------------------------

### Complete nftables tracing example

Source: https://wiki.nftables.org/wiki-nftables/index.php/Ruleset_debug/tracing

This comprehensive example illustrates the entire process of setting up and using nftables tracing. It includes loading a sample ruleset, adding a trace chain with appropriate priority, enabling tracing for packets, performing a network test (ping), and then monitoring the detailed trace output. The example highlights how trace IDs correlate packet information across different stages of rule processing.

```bash
% nft -f ruleset.nft
% nft add chain ip filter trace_chain { type filter hook prerouting priority -1\; }
% nft add rule ip filter trace_chain meta nftrace set 1
% ping -c 1 8.8.8.8
```

```text
trace id a95ea7ef ip filter trace_chain packet: iif "enp0s25" ether saddr 00:0d:b9:4a:49:3d ether daddr 3c:97:0e:39:aa:20 ip saddr 8.8.8.8 ip daddr 192.168.2.118 ip dscp cs0 ip ecn not-ect ip ttl 115 ip id 0 ip length 84 icmp type echo-reply icmp code net-unreachable icmp id 9253 icmp sequence 1 @th,64,96 24106705117628271805883024640 
trace id a95ea7ef ip filter trace_chain rule meta nftrace set 1 (verdict continue)
trace id a95ea7ef ip filter trace_chain verdict continue 
trace id a95ea7ef ip filter trace_chain policy accept 
trace id a95ea7ef ip filter input packet: iif "enp0s25" ether saddr 00:0d:b9:4a:49:3d ether daddr 3c:97:0e:39:aa:20 ip saddr 8.8.8.8 ip daddr 192.168.2.118 ip dscp cs0 ip ecn not-ect ip ttl 115 ip id 0 ip length 84 icmp type echo-reply icmp code net-unreachable icmp id 9253 icmp sequence 1 @th,64,96 24106705117628271805883024640 
trace id a95ea7ef ip filter input rule ct state established,related counter packets 168 bytes 53513 accept (verdict accept)
```

--------------------------------

### Validate nftables installation - Shell

Source: https://wiki.nftables.org/wiki-nftables/index_oldid=498&title=Building_and_installing_nftables_from_sources

This snippet shows commands to validate the nftables installation. It includes loading the 'nf_tables' kernel module using modprobe, verifying its presence with lsmod, checking dmesg for confirmation messages, and loading family support modules like 'nf_tables_ipv4'.

```shell
%modprobe nf_tables

# lsmod | grep nf_tables
nf_tables              42349  0

%dmesg
... [13939.468020] nf_tables: (c) 2007-2009 Patrick McHardy <kaber@trash.net>

%modprobe nf_tables_ipv4

# lsmod | grep nf_tables
nf_tables_ipv4         12869  0 
nf_tables              42349  1 nf_tables_ipv4

```

--------------------------------

### Complete Nftables Tracing Example

Source: https://wiki.nftables.org/wiki-nftables/api_action=feedcontributions&feedformat=atom&user=Admin

This comprehensive example illustrates the entire process of setting up and using nftrace. It includes defining a basic nftables ruleset, loading it, creating a trace chain, enabling tracing for packets, and then demonstrating the monitoring of trace events while pinging a host. This provides a practical end-to-end scenario for debugging.

```bash
table ip filter {
chain input {
type filter hook input priority filter; policy drop;
ct state established,related counter packets 2 bytes 292 accept
ct state new tcp dport 22 counter packets 0 bytes 0 accept
}
}
```

```bash
% nft -f ruleset.nft
```

```bash
% ping -c 1 8.8.8.8
```

```bash
% nft monitor trace
trace id a95ea7ef ip filter trace_chain packet: iif "enp0s25" ether saddr 00:0d:b9:4a:49:3d ether daddr 3c:97:0e:39:aa:20 ip saddr 8.8.8.8 ip daddr 192.168.2.118 ip dscp cs0 ip ecn not-ect ip ttl 115 ip id 0 ip length 84 icmp type echo-reply icmp code net-unreachable icmp id 9253 icmp sequence 1 @th,64,96 24106705117628271805883024640 <br /> trace id a95ea7ef ip filter trace_chain rule meta nftrace set 1 (verdict continue)
trace id a95ea7ef ip filter trace_chain verdict continue 
trace id a95ea7ef ip filter input packet: iif "enp0s25" ether saddr 00:0d:b9:4a:49:3d ether daddr 3c:97:0e:39:aa:20 ip saddr 8.8.8.8 ip daddr 192.168.2.118 ip dscp cs0 ip ecn not-ect ip ttl 115 ip id 0 ip length 84 icmp type echo-reply icmp code net-unreachable icmp id 9253 icmp sequence 1 @th,64,96 24106705117628271805883024640 <br /> trace id a95ea7ef ip filter input rule ct state established,relatedc
```

--------------------------------

### Validate nftables kernel module installation

Source: https://wiki.nftables.org/wiki-nftables/index_diff=prev&oldid=126&title=Building_and_installing_nftables_from_sources

Verifies the installation of the nftables kernel module by attempting to load it using 'modprobe' and then checking if it's loaded with 'lsmod'. It also shows how to check dmesg for confirmation and load family support like ipv4.

```bash
% modprobe nf_tables
# lsmod | grep nf_tables
nf_tables              42349  0
% dmesg
...[13939.468020] nf_tables: (c) 2007-2009 Patrick McHardy <kaber@trash.net>
% modprobe nf_tables_ipv4
```

--------------------------------

### Complete nftables Tracing Example

Source: https://wiki.nftables.org/wiki-nftables/api_action=feedcontributions&feedformat=atom&user=Admin

This comprehensive example illustrates the entire process of enabling and using nftrace. It includes defining a basic ruleset, loading it, creating a trace chain, adding a tracing rule, generating traffic, and monitoring the trace output.

```bash
table ip filter {
chain input {
type filter hook input priority filter; policy drop;
ct state established,related counter packets 2 bytes 292 accept
ct state new tcp dport 22 counter packets 0 bytes 0 accept
}
}
```

```bash
% nft -f ruleset.nft
```

```bash
% nft add chain ip filter trace_chain { type filter hook prerouting priority -600; }
```

```bash
% nft add rule ip filter trace_chain meta nftrace set 1
```

```bash
% ping -c 1 8.8.8.8
```

```bash
% nft monitor trace
trace id a95ea7ef ip filter trace_chain packet: iif "enp0s25" ether saddr 00:0d:b9:4a:49:3d ether daddr 3c:97:0e:39:aa:20 ip saddr 8.8.8.8 ip daddr 192.168.2.118 ip dscp cs0 ip ecn not-ect ip ttl 115 ip id 0 ip length 84 icmp type echo-reply icmp code net-unreachable icmp id 9253 icmp sequence 1 @th,64,96 24106705117628271805883024640 <br /> trace id a95ea7ef ip filter trace_chain rule meta nftrace set 1 (verdict continue)<br /> trace id a95ea7ef ip filter trace_chain verdict continue <br /> trace id a95ea7ef ip filter input packet: iif "enp0s25" ether saddr 00:0d:b9:4a:49:3d ether daddr 3c:97:0e:39:aa:20 ip saddr 8.8.8.8 ip daddr 192.168.2.118 ip dscp cs0 ip ecn not-ect ip ttl 115 ip id 0 ip length 84 icmp type echo-reply icmp code net-unreachable icmp id 9253 icmp sequence 1 @th,64,96 24106705117628271805883024640 <br /> trace id a95ea7ef ip filter input rule ct state established,related counter packets 168 bytes 53513 accept (verdict accept)<br />
```
Tokens:
Raw