Nft
Nft is the successor to iptables.
There is only one book on the market I could find (08/2022) that currently deals with Nft, and that is Linux Firewalls by Steve Suehring (this page references the 4th edition).
Usage
First, you should know there is the handy tool
iptables-translate
which can convert an iptables rule to nft. Used like so:
iptables-translate -I INPUT -p tcp --dport 22 -j DROP
and it will give the nft equivalent.
Second, you should know that in order to block ipv4 and ipv6, you should use: inet. Some rules, will have nft insert rule ip bla bla bla or nft insert rule ip6 bla bla bla. If you use inet instead of ip or ip6 it will cover both protocols. (Page 84). Any example rule online that only uses ip is incorrect.
Third:
-I is nft insert -A is nft add
Terrible... Add should be append. As with iptables, the order in which you execute the rules is important.
Fourth: you have to make your own tables, AND chains because f&*$ you that's why. What a mess.
Create tables/chains
Just copied and pasted from debian wiki. There are example tables in devuan in /usr/share/doc/nftables, but it's about as simple as Owrt's firewall (which is not simple at all) so good luck.
There is also the option to type your rules in /etc/nftables.conf. But I'm old fashioned and prefer to use cmd line rules.
Create a basic IPv4/IPv6 dual-stack table: Create a chain for input IPv4/IPv6 dual-stack traffic: A rule to check that all is fine (IPv4/IPv6 dual-stack):
nft add table inet filter nft add chain inet filter input { type filter hook input priority 0\; } nft add rule inet filter input counter accept
Show all the previous:
nft list table inet filter
Gonna take a bit to memorize this.
Allow/Block a single port
Block the wan from accessing port 80:
nft insert rule inet filter INPUT tcp dport 80 counter reject
Allow the lan to access port 80:
nft insert rule inet filter INPUT ip saddr 192.168.1.0/24 tcp dport 80 counter accept
Delete all rules
iptables -F vs nft flush ruleset
fail. Should be just nft -F.
List rules
nft list table inet filter vs iptables -L
Fail. (this assumes you used my instructions for a ipv4/ipv6 table [inet] named filter.)
The rule listing of nft is easy to read, and includes stats without the need for iptables -v -L. +1
Templates
After reading all the above nonsense, you just want something to copy and paste, here it is:
nft flush ruleset nft add table inet filter nft add chain inet filter input { type filter hook input priority 0\; } nft add rule inet filter input counter accept nft insert rule inet filter input tcp dport 80 counter reject nft insert rule inet filter input ip saddr 192.168.1.0/24 tcp dport 80 counter accept
The bare minimum to block/allow a port. Compared to:
iptables -F iptables -I INPUT -p tcp --dport 80 -j REJECT iptables -I INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
(gotcha: the table is named filter, but the chain that is type filter is distinct... Something like that, I forget exactly. Just beware.)
iptables vs nft: which is easier for the sysadmin?
I'm still undecided which is better. One thing to remember with nft is that the rules will start identical most of the time.
So a rule that is:
nft insert rule inet filter INPUT tcp dport 80 counter reject
Always has
nft insert rule inet
Which means you have to remember that part, cut it out, then focus on the rest of the rule. So all that matters is:
filter INPUT tcp dport 80 counter reject vs: -I INPUT -p tcp --dport 80 -J REJECT
Which is better?
I'm trying to give nft a chance, but my initial impressions is that some firewall admin just vomited text upon the screen for nft compared to iptables hackeresqe lean text. Well, maybe in a couple years I'll memorize nft, and by then they can make a new firewall for me to learn again. Anyways, time will tell. Jury is still out on this one.