Checking and Listing Nftables Rules

When it comes to managing your firewall rules with Nftables, knowing how to check and list your current rules is essential for troubleshooting and verifying your configurations. In this article, we’ll explore the various commands and techniques you can use to view and manage your Nftables ruleset effectively.

Understanding the Nftables Command-Line Interface

Nftables provides a user-friendly command-line interface (CLI) for managing the ruleset. The primary command used is nft. Before you dive into listing the rules, it’s useful to familiarize yourself with the basic syntax used in nft commands.

The general syntax for the nft command is:

nft [options] <command> [params]

The commands you will frequently use when checking rules include list, show, and get.

Listing Current Nftables Rules

The most straightforward way to inspect your current Nftables rules is through the nft list ruleset command. This command displays all rules and settings, providing a comprehensive overview of your current configuration. Here’s how you can do it:

Step 1: Open Your Terminal

First, open the terminal on your Linux system where Nftables is installed.

Step 2: Execute the List Command

Enter the following command:

sudo nft list ruleset

What to Expect

Upon executing the command, you’ll receive an output outlining all your current tables, chains, and rules, similar to this example:

table ip filter {
    chain input {
        type filter hook input priority 0; policy accept;
        tcp dport ssh accept
        ip saddr 192.168.1.0/24 accept
        drop
    }

    chain forward {
        type filter hook forward priority 0; policy drop;
    }
}

This output includes:

Table: Name of the table containing the chains and rules.
Chain: Defines when rules are applied (e.g., input, output, forward).
Priority: The order in which chains are processed.
Policy: Default action when no rules match—either accept or drop.

Filtering Output for Specific Tables or Chains

If you're interested in a specific table or chain rather than the entire ruleset, you can tailor your commands accordingly.

Listing a Specific Table

To list a specific table, use the following command:

sudo nft list table <table_name>

Example:

sudo nft list table ip filter

Listing a Specific Chain within a Table

If you're looking to narrow it down even further, you can list rules in a specific chain:

sudo nft list chain <table_name> <chain_name>

Example:

sudo nft list chain ip filter input

Checking Specific Rules

To further inspect or troubleshoot specific rules, you can employ the nft commands to find rules by certain criteria. This might involve examining specific protocols, ports, or source/destination addresses.

Listing Rules by Protocol or Port

If you want to check rules that are specific to a protocol or port, you can filter through the output you receive from nft list ruleset.

Tip: You can use grep to filter results easily.

sudo nft list ruleset | grep <filter_condition>

Example:

If you're interested in finding rules related to SSH:

sudo nft list ruleset | grep ssh

This command will show all rules that contain the term 'ssh', allowing you to quickly identify relevant configurations.

Viewing Nftables Statistics

Nftables also provides functionality to review statistics related to your rules, which can help in troubleshooting by understanding how many packets and bytes have matched each rule.

Using the Stats Command

To view statistics, add the -s option:

sudo nft list ruleset -s

This will give you output that includes counters indicating how many times each rule has been matched.

Example Output

The output will appear similar to this:

table ip filter {
    chain input {
        type filter hook input priority 0; policy accept;
        tcp dport ssh counter packets 152 bytes 12345 accept
        ip saddr 192.168.1.0/24 counter packets 3000 bytes 2670000 accept
        counter packets 500 bytes 45000 drop
    }
}

The keyword counter shows the count and bytes of packets that matched respective rules. Such details can provide insight into whether your rules are functioning as expected.

Making Adjustments Based on Listings

Once you’ve gathered the necessary information from your Nftables rules, it’s essential to consider whether adjustments are needed. Whether it’s adding new rules, modifying existing ones, or deleting unnecessary ones, your ability to manage these rules can significantly impact your network’s security posture.

Adding a New Rule Example

To add a new rule, use the following syntax:

sudo nft add rule <table_name> <chain_name> <match_condition> <action>

Example:

If you wanted to allow HTTP traffic, you could add:

sudo nft add rule ip filter input tcp dport http accept

Deleting a Rule Example

If you need to remove a rule, you can specify it by using the delete command:

sudo nft delete rule <table_name> <chain_name> handle <rule_handle>

To get the rule handle, you can first list the rules, identifying the rule you want to delete, and then execute the delete command based on that handle.

Final Thoughts

Regularly checking and listing your Nftables rules is a critical practice for maintaining an effective firewall configuration. By leveraging the commands and techniques highlighted in this article, you can effectively troubleshoot, verify, and modify your Nftables settings as needed.

Stay aware of which rules are actively in use and monitor the statistics for insights into your network traffic. The more informed you are about your firewall's operation, the more secure your network will be. Happy networking!

Networking & Infrastructure - Nftables