nftables
lainchan / sec

----------------------------------------------------------------------
Ender · 2025-01-04 06:21

how do you block a range of ip addresses with nftables? how do you
block ip addresses from a dynamic list?
with iptables i could do a little loop to read each line and create an
iptables rule:
`while read line; do iptables -A INPUT -s $line -j DROP; done <
file.txt`
is there a better way to do this?

----------------------------------------------------------------------
Ivan Horvat · 2025-01-04 13:04

Named sets.

>avoid rule spam bloat
>edit sets on the fly without flushing rules
>can do ranges and subnets (if flags interval  is enabled for the set)

[root@localhost ~]# nft flush ruleset ; nft -f - <<'FWRULES'
define gw = 192.168.1.1
define intnets = { 10.100.0.0/24, 100.200.0.0/24 }
define http_allowed = { $gw, $intnets, 10.150.0.0/24, 10.250.0.250,
10.2.3.4-10.5.6.6 }

table ip filter {
    set ssh_allowed {
        type ipv4_addr
        flags interval
        elements = { $gw, 172.16.24.32, $intnets, 192.168.224.192/28 }
    }
    chain input {
        type filter hook input priority 0;
        policy drop;

        ip saddr $http_allowed tcp dport { 80, 443, 8080, 8443 }
counter accept
        ip saddr @ssh_allowed tcp dport ssh counter accept
    }
}
FWRULES

----------------------------------------------------------------------
Batou · 2025-01-05 03:44

>>25661
>intervals
yeah i know... but how do you put hundreds of ips in a set? i think i
will just use iptables for this but keep core configuration in
nftables...

----------------------------------------------------------------------
Case · 2025-01-06 03:30

>>25672
>Unlike anonymous sets, elements can be added to or removed from a
named set at any time.

for i in 1.1.1.1 8.8.8.8; do
    # nft add element [ip/ip6] <table> <set> { "$i" }
    nft add element ip myTable ciaNiggers { "$i" }
done
You can check if an IP is in your set with nft get element <table>
<set> { 10.14.8.8 } , will show if it's part of an interval or subnet
too.

----------------------------------------------------------------------
Nameless · 2025-01-08 09:07

>>25675
>elements can be added to or removed from a named set at any time
got it
thank you!

----------------------------------------------------------------------
Cat Mother · 2025-01-11 23:53

i dont know what an ntable is imma have to look that up rn

----------------------------------------------------------------------
Agent Smith · 2025-01-12 00:11

>>25698
>what an ntable is
nano troon able. It depicts a deformed kid ranging from 13 to 16,
mostly down syndrome, who's able (nicer way of saying not clinically
retarded) enough to LARP as a security expert by copy pasting sheets
from Theo (mostly the x86 virtualization mail), Madaidan and the
grugq. Their habitat usually resides in the now dead nanochan, the
lainchan >>>/sec/ and the lambdachan /tech/. Only a fool would take
them seriously

----------------------------------------------------------------------
Hououin Kyouma · 2025-01-16 09:42

>>25698
nftables is to iptables what systemd is to sysvinit

>>25699
>It depicts a deformed kid ranging from 13 to 16, mostly down syndrome
She was 13 in season 5.