nftables - managing .conf with dynamic ruleset compared to ipset?

drankinatty · Today 07:48:14

My Arch server suffered a hardware POOF after 12 years of service[2]. Moved to backup box, but used nftables instead of iptables/ipset this time. nftables works well, but one issue is saving the config file.

With ipset, you simply used ipset -o save save > /etc/ipset.conf and it would save the sets in a form to be loaded by ipset on restart/reboot. With nftables, the wiki[1] suggests nft -s list ruleset > filename (/etc/nftables.conf). However this doesn't store the full config or preamble to destroy the current ruleset before reloading, e.g.

#!/usr/bin/nft -f
# vim:set ts=2 sw=2 et:

destroy table inet filter
...

The wiki does note

nft list does not output variable definitions, if you had any in your original file they will be lost. Any variables used in rules will be replaced by their value.

, and that is the point.

While you can script the preamble inclusion relatively easily, is there a better, more standard way to handle writing the config file after updating the ruleset so that all the original config is preserved?

I currently just cat the preamble and the ruleset to make the updated config -- and if there is no more standard way, that works fine

The other issue with capturing the ruleset as the next config is that it also captures all Fail2Ban additions as well, which can be lengthy. It works fine, so no complaints whether it's captured or not, but with iptables/ipset Fail2Ban additions were not captured but simply restored by Fail2Ban on restart/reboot. There doesn't seem to be a problem capturing the Fail2Ban additions in the nftables.conf. On restart/reboot Fail2Ban sees what it expects to be in the ruleset and from what I can tell is happy with it. Is there a problem with doing it this way that I may be overlooking?"

Sorry if that seem obvious, but I tend to want to double and triple check anything that I do that is exposed to the wider internet. Any advise/experience you can share on these issues would be appreciated.

[1] https://wiki.archlinux.org/title/Nftabl … t_rule_set
[2] it is a voltage issue somewhere, either MB/capacitor or in the processor itself. Verified with multiple power-supplies.

dimich · Today 08:37:51

drankinatty wrote:

it would save the sets in a form to be loaded by ipset on restart/reboot.

Not the answer to your question, but just reflection: isn't the point of dynamic rules precisely to fill it dynamically at runtime? I.e. default ruleset is written by user and stored in /etc/ntfables.conf once. After it is loaded, services extend the ruleset with their rules as they start, generating rules from own configs/databases etc.

seth · Today 18:23:11

You're aware that https://wiki.archlinux.org/title/Iptables is just a shim wrapping nftables?
You can technically just continue to use it resp. configure nftables through it, https://wiki.archlinux.org/title/Nftabl … tables-nft

If you don't want to use that or some higher level abstraction like UFW you'd configure it w/ a text editor.
https://wiki.archlinux.org/title/Nftabl … t_rule_set is kinda more for transient preservation in persistent memory (at least afaiu)

Edit: this tab was kept open waaaaay too long

Last edited by seth (Today 18:37:47)

Arch Linux

#1 Today 07:48:14

nftables - managing .conf with dynamic ruleset compared to ipset?

#2 Today 08:37:51

Re: nftables - managing .conf with dynamic ruleset compared to ipset?

#3 Today 18:23:11

Re: nftables - managing .conf with dynamic ruleset compared to ipset?

Board footer