NFTABLES [PART - 1] : "Concept and Syntax"

Introduction

This tutorial provides a comprehensive guide to understanding the basics of nftables, a modern packet classification framework that replaces iptables in the Linux kernel. This is the first part of a two-part series where we will explore fundamental concepts, features, and syntax related to nftables. By the end of this tutorial, you will have a solid foundation to work with nftables effectively.

Step 1: Understanding Nftables

• Definition: Nftables stands for Net Filter Table, which is integrated into the Linux kernel.
• Purpose: It manages network traffic filtering and classification.
• Advantages:
  • Simplifies the management of firewall rules.
  • Offers a single framework for both IPv4 and IPv6.
  • Supports richer features like stateful packet filtering.

Step 2: Familiarizing with Nftables Syntax

• Basic Structure: The syntax of nftables is designed to be straightforward and human-readable.

• Commands:

  • nft add table <family> <table_name>
  • nft add chain <family> <table_name> <chain_name> { type filter hook input priority 0; }
  • nft add rule <table_name> <chain_name> <condition> <action>

  Example of creating a table and adding a chain:

  nft add table ip filter
  nft add chain ip filter input { type filter hook input priority 0; }
  

Step 3: Creating Tables

• What is a Table?: A table is a container for chains and rules.
• How to Create a Table:
  • Use the command:

    nft add table ip filter
    

  • Replace ip with ip6 for IPv6 tables.

Step 4: Setting Up Chains

• Understanding Chains: Chains are used to define a sequence of rules that will be evaluated on packets.
• Creating a Chain:
  • Command example:

    nft add chain ip filter input { type filter hook input priority 0; }
    

  • Set chain types (e.g., filter, nat) and hooks (input, output, forward).

Step 5: Defining Rules

• What are Rules?: Rules specify actions taken on packets that match certain conditions.
• Creating a Rule:
  • Use the command format:

    nft add rule <table_name> <chain_name> <condition> <action>
    

  • Example:

    nft add rule ip filter input ip saddr 192.168.1.0/24 accept
    

Conclusion

In this tutorial, we covered the foundational concepts of nftables, including its syntax, tables, chains, and rules. Understanding these elements is crucial for effective network traffic management in Linux. Next steps may include exploring advanced features of nftables or diving into the second part of this series for practical applications and live demonstrations. For more resources, consider visiting the nftables Wiki or checking out the man page for additional command options.