Procedure

1. Copy the example playbook for the SSHD System Role:

   # cp /usr/share/doc/rhel-system-roles/sshd/example-root-login-playbook.yml path/custom-playbook.yml

2. Open the copied playbook by using a text editor, for example:

   # vim path/custom-playbook.yml
   
   ---
   - hosts: all
     tasks:
     - name: Configure sshd to prevent root and password login except from particular subnet
       include_role:
         name: rhel-system-roles.sshd
       vars:
         sshd:
           # root login and password login is enabled only from a particular subnet
           PermitRootLogin: no
           PasswordAuthentication: no
           Match:
           - Condition: "Address 192.0.2.0/24"
             PermitRootLogin: yes
             PasswordAuthentication: yes

   The playbook configures the managed node as an SSH server configured so that:

   • password and root user login is disabled
   • password and root user login is enabled only from the subnet 192.0.2.0/24

   You can modify the variables according to your preferences. For more details, see SSHD Server System Role variables .

3. Optional: Verify playbook syntax.

   # ansible-playbook --syntax-check path/custom-playbook.yml

4. Run the playbook on your inventory file:

   # ansible-playbook -i inventory_file path/custom-playbook.yml
   
   ...
   
   PLAY RECAP
   **************************************************
   
   localhost : ok=12 changed=2 unreachable=0 failed=0
   skipped=10 rescued=0 ignored=0

Verification

1. Log in to the SSH server:

   $ ssh user1@10.1.1.1

   Where:

   • user1 is a user on the SSH server.
   • 10.1.1.1 is the IP address of the SSH server.

2. Check the contents of the sshd_config file on the SSH server:

   $ vim /etc/ssh/sshd_config
   
   # Ansible managed
   HostKey /etc/ssh/ssh_host_rsa_key
   HostKey /etc/ssh/ssh_host_ecdsa_key
   HostKey /etc/ssh/ssh_host_ed25519_key
   AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
   AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
   AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
   AcceptEnv XMODIFIERS
   AuthorizedKeysFile .ssh/authorized_keys
   ChallengeResponseAuthentication no
   GSSAPIAuthentication yes
   GSSAPICleanupCredentials no
   PasswordAuthentication no
   PermitRootLogin no
   PrintMotd no
   Subsystem sftp /usr/libexec/openssh/sftp-server
   SyslogFacility AUTHPRIV
   UsePAM yes
   X11Forwarding yes
   Match Address 192.0.2.0/24
     PasswordAuthentication yes
     PermitRootLogin yes

3. Check that you can connect to the server as root from the 192.0.2.0/24 subnet:

   1. Determine your IP address:

      $ hostname -I
      192.0.2.1

      If the IP address is within the 192.0.2.1 - 192.0.2.254 range, you can connect to the server.

   2. Connect to the server as root:

      $ ssh root@10.1.1.1

Procedure

1. Create a new playbook.yml file with the following content:

   ---
   - hosts: all
     tasks:
     - name: "Configure ssh clients"
       include_role:
         name: rhel-system-roles.ssh
       vars:
         ssh_user: root
         ssh:
           Compression: true
           GSSAPIAuthentication: no
           ControlMaster: auto
           ControlPath: ~/.ssh/.cm%C
           Host:
             - Condition: example
               Hostname: example.com
               User: user1
         ssh_ForwardX11: no

   This playbook configures the root user’s SSH client preferences on the managed nodes with the following configurations:

   • Compression is enabled.
   • ControlMaster multiplexing is set to auto.
   • The example alias for connecting to the example.com host is user1.
   • The example host alias is created, which represents a connection to the example.com host the with user1 user name.
   • X11 forwarding is disabled.

   Optionally, you can modify these variables according to your preferences. For more details, see SSH Client Role variables .

2. Optional: Verify playbook syntax.

   # ansible-playbook --syntax-check path/custom-playbook.yml

3. Run the playbook on your inventory file:

   # ansible-playbook -i inventory_file path/custom-playbook.yml

Procedure

1. To see the status of the service:

   # firewall-cmd --state

2. For more information about the service status, use the systemctl status sub-command:

   # systemctl status firewalld
   firewalld.service - firewalld - dynamic firewall daemon
      Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor pr
      Active: active (running) since Mon 2017-12-18 16:05:15 CET; 50min ago
        Docs: man:firewalld(1)
    Main PID: 705 (firewalld)
       Tasks: 2 (limit: 4915)
      CGroup: /system.slice/firewalld.service
              └─705 /usr/bin/python3 -Es /usr/sbin/firewalld --nofork --nopid

Procedure

1. To immediately disable networking traffic, switch panic mode on:

   # firewall-cmd --panic-on

   Important

   Enabling panic mode stops all networking traffic. For this reason, it should be used only when you have the physical access to the machine or if you are logged in using a serial console.

2. Switching off panic mode reverts the firewall to its permanent settings. To switch panic mode off, enter:

   # firewall-cmd --panic-off

Procedure

1. Check that the service is not already allowed:

   # firewall-cmd --list-services
   ssh dhcpv6-client

2. List all predefined services:

   # firewall-cmd --get-services
   RH-Satellite-6 amanda-client amanda-k5-client bacula bacula-client bitcoin bitcoin-rpc bitcoin-testnet bitcoin-testnet-rpc ceph ceph-mon cfengine condor-collector ctdb dhcp dhcpv6 dhcpv6-client dns docker-registry ...
   [trimmed for clarity]

3. Add the service to the allowed services:

   # firewall-cmd --add-service=<service-name>

4. Make the new settings persistent:

   # firewall-cmd --runtime-to-permanent

Procedure

1. To enable or disable a predefined or custom service:

   1. Start the firewall-config tool and select the network zone whose services are to be configured.
   2. Select the Services tab.
   3. Select the check box for each type of service you want to trust or clear the check box to block a service.

2. To edit a service:

   1. Start the firewall-config tool.
   2. Select Permanent from the menu labeled Configuration. Additional icons and menu buttons appear at the bottom of the Services window.
   3. Select the service you want to configure.

1. Enter the following command to add a new and empty service:

   $ firewall-cmd --new-service=service-name --permanent

2. To add a new service using a local file, use the following command:

   $ firewall-cmd --new-service-from-file=service-name.xml --permanent

   You can change the service name with the additional --name=service-name option.

3. As soon as service settings are changed, an updated copy of the service is placed into /etc/firewalld/services/.

   As root, you can enter the following command to copy a service manually:

   # cp /usr/lib/firewalld/services/service-name.xml /etc/firewalld/services/service-name.xml

1. Start the firewall-config tool and select the network zone whose settings you want to change.
2. Select the Ports tab and click the Add button on the right-hand side. The Port and Protocol window opens.
3. Enter the port number or range of ports to permit.
4. Select tcp or udp from the list.

1. Start the firewall-config tool and select the network zone whose settings you want to change.
2. Select the Protocols tab and click the Add button on the right-hand side. The Protocol window opens.
3. Either select a protocol from the list or select the Other Protocol check box and enter the protocol in the field.

1. Start the firewall-config tool and select the network zone whose settings you want to change.
2. Select the Source Port tab and click the Add button on the right-hand side. The Source Port window opens.
3. Enter the port number or range of ports to permit. Select tcp or udp from the list.

1. List all allowed ports:

   # firewall-cmd --list-ports

2. Add a port to the allowed ports to open it for incoming traffic:

   # firewall-cmd --add-port=port-number/port-type

   The port types are either tcp, udp, sctp, or dccp. The type must match the type of network communication.

3. Make the new settings persistent:

   # firewall-cmd --runtime-to-permanent

   The port types are either tcp, udp, sctp, or dccp. The type must match the type of network communication.

1. List all allowed ports:

   # firewall-cmd --list-ports

   Warning

   This command will only give you a list of ports that have been opened as ports. You will not be able to see any open ports that have been opened as a service. Therefore, you should consider using the --list-all option instead of --list-ports.

2. Remove the port from the allowed ports to close it for the incoming traffic:

   # firewall-cmd --remove-port=port-number/port-type

3. Make the new settings persistent:

   # firewall-cmd --runtime-to-permanent

Procedure

1. To see which zones are available on your system:

   # firewall-cmd --get-zones

   The firewall-cmd --get-zones command displays all zones that are available on the system, but it does not show any details for particular zones.

2. To see detailed information for all zones:

   # firewall-cmd --list-all-zones

3. To see detailed information for a specific zone:

   # firewall-cmd --zone=zone-name --list-all

1. Display the current default zone:

   # firewall-cmd --get-default-zone

2. Set the new default zone:

   # firewall-cmd --set-default-zone zone-name

   Note

   Following this procedure, the setting is a permanent setting, even without the --permanent option.

1. List the active zones and the interfaces assigned to them:

   # firewall-cmd --get-active-zones

2. Assign the interface to a different zone:

   # firewall-cmd --zone=zone_name --change-interface=interface_name --permanent

Procedure

1. Assign the zone to the NetworkManager connection profile:

   # nmcli connection modify profile connection.zone zone_name

2. Reload the connection:

   # nmcli connection up profile

Procedure

1. Create a new zone:

   # firewall-cmd --new-zone=zone-name

2. Check if the new zone is added to your permanent settings:

   # firewall-cmd --get-zones

3. Make the new settings persistent:

   # firewall-cmd --runtime-to-permanent

1. List the information for the specific zone to see the default target:

   $ firewall-cmd --zone=zone-name --list-all

2. Set a new target in the zone:

   # firewall-cmd --permanent --zone=zone-name --set-target=<default|ACCEPT|REJECT|DROP>

Procedure

1. List all available zones:

   # firewall-cmd --get-zones

2. Add the source IP to the trusted zone in the permanent mode:

   # firewall-cmd --zone=trusted --add-source=192.168.2.15

3. Make the new settings persistent:

   # firewall-cmd --runtime-to-permanent

Procedure

1. List allowed sources for the required zone:

   # firewall-cmd --zone=zone-name --list-sources

2. Remove the source from the zone permanently:

   # firewall-cmd --zone=zone-name --remove-source=<source>

3. Make the new settings persistent:

   # firewall-cmd --runtime-to-permanent

Procedure

1. List all available zones:

   # firewall-cmd --get-zones
   block dmz drop external home internal public trusted work

2. Add the IP range to the internal zone to route the traffic originating from the source through the zone:

   # firewall-cmd --zone=internal --add-source=192.0.2.0/24

3. Add the http service to the internal zone:

   # firewall-cmd --zone=internal --add-service=http

4. Make the new settings persistent:

   # firewall-cmd --runtime-to-permanent

Procedure

1. To check if IP masquerading is enabled (for example, for the external zone), enter the following command as root:

   # firewall-cmd --zone=external --query-masquerade

   The command prints yes with exit status 0 if enabled. It prints no with exit status 1 otherwise. If zone is omitted, the default zone will be used.

2. To enable IP masquerading, enter the following command as root:

   # firewall-cmd --zone=external --add-masquerade

3. To make this setting persistent, repeat the command adding the --permanent option.

Procedure

1. To redirect a port to another port:

   # firewall-cmd --add-forward-port=port=port-number:proto=tcp|udp|sctp|dccp:toport=port-number

2. To redirect a port to another port at a different IP address:

   1. Add the port to be forwarded:

      # firewall-cmd --add-forward-port=port=port-number:proto=tcp|udp:toport=port-number:toaddr=IP

   2. Enable masquerade:

      # firewall-cmd --add-masquerade

Procedure

1. Redirect the port 80 to port 88 for TCP traffic:

   # firewall-cmd --add-forward-port=port=80:proto=tcp:toport=88

2. Make the new settings persistent:

   # firewall-cmd --runtime-to-permanent

3. Check that the port is redirected:

   # firewall-cmd --list-all

Procedure

1. To remove a redirected port:

   # firewall-cmd --remove-forward-port=port=port-number:proto=<tcp|udp>:toport=port-number:toaddr=<IP>

2. To remove a forwarded port redirected to a different address:

   1. Remove the forwarded port:

      # firewall-cmd --remove-forward-port=port=port-number:proto=<tcp|udp>:toport=port-number:toaddr=<IP>

   2. Disable masquerade:

      # firewall-cmd --remove-masquerade

Procedure

1. List redirected ports:

   ~]# firewall-cmd --list-forward-ports
   port=80:proto=tcp:toport=88:toaddr=

2. Remove the redirected port from the firewall::

   ~]# firewall-cmd  --remove-forward-port=port=80:proto=tcp:toport=88:toaddr=

3. Make the new settings persistent:

   ~]# firewall-cmd --runtime-to-permanent

1. Set the target of your zone to DROP:

   # firewall-cmd --permanent --set-target=DROP

2. Add the ICMP block inversion to block all ICMP requests at once:

   # firewall-cmd --add-icmp-block-inversion

3. Add the ICMP block for those ICMP requests that you want to allow:

   # firewall-cmd --add-icmp-block=<icmptype>

4. Make the new settings persistent:

   # firewall-cmd --runtime-to-permanent

1. Set the target of your zone to default or ACCEPT:

   # firewall-cmd --permanent --set-target=default

2. Remove all added blocks for ICMP requests:

   # firewall-cmd --remove-icmp-block=<icmptype>

3. Remove the ICMP block inversion:

   # firewall-cmd --remove-icmp-block-inversion

4. Make the new settings persistent:

   # firewall-cmd --runtime-to-permanent

Procedure

1. Add a rich rule with a very low precedence to log all traffic that has not been matched by other rules:

   # firewall-cmd --add-rich-rule='rule priority=32767 log prefix="UNEXPECTED: " limit value="5/m"'

   The command additionally limits the number of log entries to 5 per minute.

2. Optionally, display the nftables rule that the command in the previous step created:

   # nft list chain inet firewalld filter_IN_public_post
   table inet firewalld {
     chain filter_IN_public_post {
       log prefix "UNEXPECTED: " limit rate 5/minute
     }
   }

Procedure

1. Edit the /etc/sysconfig/nftables.conf file.

   • If you enhance *.nft scripts created in /etc/nftables/ when you installed the nftables package, uncomment the include statement for these scripts.

   • If you write scripts from scratch, add include statements to include these scripts. For example, to load the /etc/nftables/example.nft script when the nftables service starts, add:

     include "/etc/nftables/example.nft"

2. Optionally, start the nftables service to load the firewall rules without rebooting the system:

   # systemctl start nftables

3. Enable the nftables service.

   # systemctl enable nftables

Procedure

1. Use the nft add table command to create a new table. For example, to create a table named example_table that processes IPv4 and IPv6 packets:

   # nft add table inet example_table

2. Optionally, list all tables in the rule set:

   # nft list tables
   table inet example_table

Procedure

1. Use the nft add chain command to create a new chain. For example, to create a chain named example_chain in example_table:

   # nft add chain inet example_table example_chain { type filter hook input priority 0 \; policy accept \; }

   Important

   To avoid that the shell interprets the semicolons as the end of the command, prepend the semicolons the \ escape character.

   This chain filters incoming packets. The priority parameter specifies the order in which nftables processes chains with the same hook value. A lower priority value has precedence over higher ones. The policy parameter sets the default action for rules in this chain. Note that if you are logged in to the server remotely and you set the default policy to drop, you are disconnected immediately if no other rule allows the remote access.

2. Optionally, display all chains:

   # nft list chains
   table inet example_table {
     chain example_chain {
       type filter hook input priority filter; policy accept;
     }
   }

Procedure

1. To add a new rule, use the nft add rule command. For example, to add a rule to the example_chain in the example_table that allows TCP traffic on port 22:

   # nft add rule inet example_table example_chain tcp dport 22 accept

   Instead of the port number, you can alternatively specify the name of the service. In the example, you could use ssh instead of the port number 22. Note that a service name is resolved to a port number based on its entry in the /etc/services file.

2. Optionally, display all chains and their rules in example_table:

   # nft list table inet example_table
   table inet example_table {
     chain example_chain {
       type filter hook input priority filter; policy accept;
       ...
       tcp dport ssh accept
     }
   }

Procedure

1. To insert a new rule, use the nft insert rule command. For example, to insert a rule to the example_chain in the example_table that allows TCP traffic on port 22:

   # nft insert rule inet example_table example_chain tcp dport 22 accept

   You can alternatively specify the name of the service instead of the port number. In the example, you could use ssh instead of the port number 22. Note that a service name is resolved to a port number based on its entry in the /etc/services file.

2. Optionally, display all chains and their rules in example_table:

   # nft list table inet example_table
   table inet example_table {
     chain example_chain {
       type filter hook input priority filter; policy accept;
       tcp dport ssh accept
       ...
     }
   }

Procedure

1. Use the nft -a list ruleset command to display all chains and their rules in the example_table including their handle:

   # nft -a list table inet example_table
   table inet example_table { # handle 1
     chain example_chain { # handle 1
       type filter hook input priority filter; policy accept;
       tcp dport 22 accept # handle 2
       tcp dport 443 accept # handle 3
       tcp dport 389 accept # handle 4
     }
   }

   Using the -a displays the handles. You require this information to position the new rules in the next steps.

2. Insert the new rules to the example_chain chain in the example_table:

   • To insert a rule that allows TCP traffic on port 636 before handle 3, enter:

     # nft insert rule inet example_table example_chain position 3 tcp dport 636 accept

   • To add a rule that allows TCP traffic on port 80 after handle 3, enter:

     # nft add rule inet example_table example_chain position 3 tcp dport 80 accept

3. Optionally, display all chains and their rules in example_table:

   # nft -a list table inet example_table
   table inet example_table { # handle 1
     chain example_chain { # handle 1
       type filter hook input priority filter; policy accept;
       tcp dport 22 accept # handle 2
       tcp dport 636 accept # handle 5
       tcp dport 443 accept # handle 3
       tcp dport 80 accept # handle 6
       tcp dport 389 accept # handle 4
     }
   }

Procedure

1. Create a table:

   # nft add table nat

2. Add the prerouting and postrouting chains to the table:

   # nft -- add chain nat prerouting { type nat hook prerouting priority -100 \; }
   # nft add chain nat postrouting { type nat hook postrouting priority 100 \; }

   Important

   Even if you do not add a rule to the prerouting chain, the nftables framework requires this chain to match incoming packet replies.

   Note that you must pass the -- option to the nft command to avoid that the shell interprets the negative priority value as an option of the nft command.

3. Add a rule to the postrouting chain that matches outgoing packets on the ens3 interface:

   # nft add rule nat postrouting oifname "ens3" masquerade

Procedure

1. Create a table:

   # nft add table nat

2. Add the prerouting and postrouting chains to the table:

   # nft -- add chain nat prerouting { type nat hook prerouting priority -100 \; }
   # nft add chain nat postrouting { type nat hook postrouting priority 100 \; }

   Important

   Even if you do not add a rule to the postrouting chain, the nftables framework requires this chain to match outgoing packet replies.

   Note that you must pass the -- option to the nft command to avoid that the shell interprets the negative priority value as an option of the nft command.

3. Add a rule to the postrouting chain that replaces the source IP of outgoing packets through ens3 with 192.0.2.1:

   # nft add rule nat postrouting oifname "ens3" snat to 192.0.2.1

Procedure

1. Create a table:

   # nft add table nat

2. Add the prerouting and postrouting chains to the table:

   # nft -- add chain nat prerouting { type nat hook prerouting priority -100 \; }
   # nft add chain nat postrouting { type nat hook postrouting priority 100 \; }

   Important

   Even if you do not add a rule to the postrouting chain, the nftables framework requires this chain to match outgoing packet replies.

   Note that you must pass the -- option to the nft command to avoid that the shell interprets the negative priority value as an option of the nft command.

3. Add a rule to the prerouting chain that redirects incoming traffic on the ens3 interface sent to port 80 and 443 to the host with the 192.0.2.1 IP:

   # nft add rule nat prerouting iifname ens3 tcp dport { 80, 443 } dnat to 192.0.2.1

4. Depending on your environment, add either a SNAT or masquerading rule to change the source address:

   1. If the ens3 interface used dynamic IP addresses, add a masquerading rule:

      # nft add rule nat postrouting oifname "ens3" masquerade

   2. If the ens3 interface uses a static IP address, add a SNAT rule. For example, if the ens3 uses the 198.51.100.1 IP address:

      # nft add rule nat postrouting oifname "ens3" snat to 198.51.100.1

Procedure

1. Create a table:

   # nft add table nat

2. Add the prerouting chain to the table:

   # nft -- add chain nat prerouting { type nat hook prerouting priority -100 \; }

   Note that you must pass the -- option to the nft command to avoid that the shell interprets the negative priority value as an option of the nft command.

3. Add a rule to the prerouting chain that redirects incoming traffic on port 22 to port 2222:

   # nft add rule nat prerouting tcp dport 22 redirect to 2222

Procedure

1. For example, to add a rule to example_chain in example_table that allows incoming traffic to port 22, 80, and 443:

   # nft add rule inet example_table example_chain tcp dport { 22, 80, 443 } accept

2. Optionally, display all chains and their rules in example_table:

   # nft list table inet example_table
   table inet example_table {
     chain example_chain {
       type filter hook input priority filter; policy accept;
       tcp dport { ssh, http, https } accept
     }
   }

Procedure

1. Create an empty set. The following examples create a set for IPv4 addresses:

   • To create a set that can store multiple individual IPv4 addresses:

     # nft add set inet example_table example_set { type ipv4_addr \; }

   • To create a set that can store IPv4 address ranges:

     # nft add set inet example_table example_set { type ipv4_addr \; flags interval \; }

   Important

   To avoid that the shell interprets the semicolons as the end of the command, you must escape the semicolons with a backslash.

2. Optionally, create rules that use the set. For example, the following command adds a rule to the example_chain in the example_table that will drop all packets from IPv4 addresses in example_set.

   # nft add rule inet example_table example_chain ip saddr @example_set drop

   Because example_set is still empty, the rule has currently no effect.

3. Add IPv4 addresses to example_set:

   • If you create a set that stores individual IPv4 addresses, enter:

     # nft add element inet example_table example_set { 192.0.2.1, 192.0.2.2 }

   • If you create a set that stores IPv4 ranges, enter:

     # nft add element inet example_table example_set { 192.0.2.0-192.0.2.255 }

     When you specify an IP address range, you can alternatively use the Classless Inter-Domain Routing (CIDR) notation, such as 192.0.2.0/24 in the above example.

Procedure

1. Create the example_table:

   # nft add table inet example_table

2. Create the tcp_packets chain in example_table:

   # nft add chain inet example_table tcp_packets

3. Add a rule to tcp_packets that counts the traffic in this chain:

   # nft add rule inet example_table tcp_packets counter

4. Create the udp_packets chain in example_table

   # nft add chain inet example_table udp_packets

5. Add a rule to udp_packets that counts the traffic in this chain:

   # nft add rule inet example_table udp_packets counter

6. Create a chain for incoming traffic. For example, to create a chain named incoming_traffic in example_table that filters incoming traffic:

   # nft add chain inet example_table incoming_traffic { type filter hook input priority 0 \; }

7. Add a rule with an anonymous map to incoming_traffic:

   # nft add rule inet example_table incoming_traffic ip protocol vmap { tcp : jump tcp_packets, udp : jump udp_packets }

   The anonymous map distinguishes the packets and sends them to the different counter chains based on their protocol.

8. To list the traffic counters, display example_table:

   # nft list table inet example_table
   table inet example_table {
     chain tcp_packets {
       counter packets 36379 bytes 2103816
     }
   
     chain udp_packets {
       counter packets 10 bytes 1559
     }
   
     chain incoming_traffic {
       type filter hook input priority filter; policy accept;
       ip protocol vmap { tcp : jump tcp_packets, udp : jump udp_packets }
     }
   }

   The counters in the tcp_packets and udp_packets chain display both the number of received packets and bytes.

Procedure

1. Create a table. For example, to create a table named example_table that processes IPv4 packets:

   # nft add table ip example_table

2. Create a chain. For example, to create a chain named example_chain in example_table:

   # nft add chain ip example_table example_chain { type filter hook input priority 0 \; }

   Important

   To avoid that the shell interprets the semicolons as the end of the command, you must escape the semicolons with a backslash.

3. Create an empty map. For example, to create a map for IPv4 addresses:

   # nft add map ip example_table example_map { type ipv4_addr : verdict \; }

4. Create rules that use the map. For example, the following command adds a rule to example_chain in example_table that applies actions to IPv4 addresses which are both defined in example_map:

   # nft add rule example_table example_chain ip saddr vmap @example_map

5. Add IPv4 addresses and corresponding actions to example_map:

   # nft add element ip example_table example_map { 192.0.2.1 : accept, 192.0.2.2 : drop }

   This example defines the mappings of IPv4 addresses to actions. In combination with the rule created above, the firewall accepts packet from 192.0.2.1 and drops packets from 192.0.2.2.

6. Optionally, enhance the map by adding another IP address and action statement:

   # nft add element ip example_table example_map { 192.0.2.3 : accept }

7. Optionally, remove an entry from the map:

   # nft delete element ip example_table example_map { 192.0.2.1 }

8. Optionally, display the rule set:

   # nft list ruleset
   table ip example_table {
     map example_map {
       type ipv4_addr : verdict
       elements = { 192.0.2.2 : drop, 192.0.2.3 : accept }
     }
   
     chain example_chain {
       type filter hook input priority filter; policy accept;
       ip saddr vmap @example_map
     }
   }

Procedure

1. Create a table named nat with the ip address family:

   # nft add table ip nat

2. Add the prerouting and postrouting chains to the table:

   # nft -- add chain ip nat prerouting { type nat hook prerouting priority -100 \; }

   Note

   Pass the -- option to the nft command to avoid that the shell interprets the negative priority value as an option of the nft command.

3. Add a rule to the prerouting chain that redirects incoming packets on port 8022 to the local port 22:

   # nft add rule ip nat prerouting tcp dport 8022 redirect to :22

Procedure

1. Create a table named nat with the ip address family:

   # nft add table ip nat

2. Add the prerouting and postrouting chains to the table:

   # nft -- add chain ip nat prerouting { type nat hook prerouting priority -100 \; }
   # nft add chain ip nat postrouting { type nat hook postrouting priority 100 \; }

   Note

   Pass the -- option to the nft command to avoid that the shell interprets the negative priority value as an option of the nft command.

3. Add a rule to the prerouting chain that redirects incoming packets on port 443 to the same port on 192.0.2.1:

   # nft add rule ip nat prerouting tcp dport 443 dnat to 192.0.2.1

4. Add a rule to the postrouting chain to masquerade outgoing traffic:

   # nft add rule ip daddr 192.0.2.1 masquerade

5. Enable packet forwarding:

   # echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf
   # sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf

Procedure

1. Add a rule that allows only two simultaneous connections to the SSH port (22) from an IPv4 address and rejects all further connections from the same IP:

   # nft add rule ip example_table example_chain tcp dport ssh meter example_meter { ip saddr ct count over 2 } counter reject

2. Optionally, display the meter created in the previous step:

   # nft list meter ip example_table example_meter
   table ip example_table {
     meter example_meter {
       type ipv4_addr
       size 65535
       elements = { 192.0.2.1 : ct count over 2 , 192.0.2.2 : ct count over 2  }
     }
   }

   The elements entry displays addresses that currently match the rule. In this example, elements lists IP addresses that have active connections to the SSH port. Note that the output does not display the number of active connections or if connections were rejected.

Procedure

1. Create the filter table with the ip address family:

   # nft add table ip filter

2. Add the input chain to the filter table:

   # nft add chain ip filter input { type filter hook input priority 0 \; }

3. Add a set named denylist to the filter table:

   # nft add set ip filter denylist { type ipv4_addr \; flags dynamic, timeout \; timeout 5m \; }

   This command creates a dynamic set for IPv4 addresses. The timeout 5m parameter defines that nftables automatically removes entries after 5 minutes from the set.

4. Add a rule that automatically adds the source IP address of hosts that attempt to establish more than ten new TCP connections within one minute to the denylist set:

   # nft add rule ip filter input ip protocol tcp ct state new, untracked limit rate over 10/minute add @denylist { ip saddr }

5. Add a rule that drops all connections from IP addresses in the denylist set:

   # nft add rule ip filter input ip saddr @denylist drop

Procedure

1. Add a new rule with the counter parameter to the chain. The following example adds a rule with a counter that allows TCP traffic on port 22 and counts the packets and traffic that match this rule:

   # nft add rule inet example_table example_chain tcp dport 22 counter accept

2. To display the counter values:

   # nft list ruleset
   table inet example_table {
     chain example_chain {
       type filter hook input priority filter; policy accept;
       tcp dport ssh counter packets 6872 bytes 105448565 accept
     }
   }

Procedure

1. Display the rules in the chain including their handles:

   # nft --handle list chain inet example_table example_chain
   table inet example_table {
     chain example_chain { # handle 1
       type filter hook input priority filter; policy accept;
       tcp dport ssh accept # handle 4
     }
   }

2. Add the counter by replacing the rule but with the counter parameter. The following example replaces the rule displayed in the previous step and adds a counter:

   # nft replace rule inet example_table example_chain handle 4 tcp dport 22 counter accept

3. To display the counter values:

   # nft list ruleset
   table inet example_table {
     chain example_chain {
       type filter hook input priority filter; policy accept;
       tcp dport ssh counter packets 6872 bytes 105448565 accept
     }
   }

Procedure

1. Display the rules in the chain including their handles:

   # nft --handle list chain inet example_table example_chain
   table inet example_table {
     chain example_chain { # handle 1
       type filter hook input priority filter; policy accept;
       tcp dport ssh accept # handle 4
     }
   }

2. Add the tracing feature by replacing the rule but with the meta nftrace set 1 parameters. The following example replaces the rule displayed in the previous step and enables tracing:

   # nft replace rule inet example_table example_chain handle 4 tcp dport 22 meta nftrace set 1 accept

3. Use the nft monitor command to display the tracing. The following example filters the output of the command to display only entries that contain inet example_table example_chain:

   # nft monitor | grep "inet example_table example_chain"
   trace id 3c5eb15e inet example_table example_chain packet: iif "enp1s0" ether saddr 52:54:00:17:ff:e4 ether daddr 52:54:00:72:2f:6e ip saddr 192.0.2.1 ip daddr 192.0.2.2 ip dscp cs0 ip ecn not-ect ip ttl 64 ip id 49710 ip protocol tcp ip length 60 tcp sport 56728 tcp dport ssh tcp flags == syn tcp window 64240
   trace id 3c5eb15e inet example_table example_chain rule tcp dport ssh nftrace set 1 accept (verdict accept)
   ...

   Warning

   Depending on the number of rules with tracing enabled and the amount of matching traffic, the nft monitor command can display a lot of output. Use grep or other utilities to filter the output.