On Wed, 13 May 2020 22:57:42 -0500
info(a)itwrx.org wrote:
> On 5/13/20 10:02 PM, D&R wrote:
> > nftable.conf is setup as:
> >
> > flush ruleset
> > table inet nat {
> > chain postrouting {
> > type nat hook postrouting priority srcnat; policy accept;
> > masquerade random,persistent
> > }
> > }
> > table inet filter {
> > chain input {
> > type filter hook input priority filter; policy drop;
> > counter jump block
> > }
> > chain forward {
> > type filter hook forward priority filter; policy drop;
> > counter jump block
> > }
> > chain output {
> > type filter hook output priority filter; policy accept;
> > }
> > chain block {
> > ct state { established, related } counter accept comment
> > "accept all connections related to connections made by us" iifname
> > "enp1s0" counter accept iifname "enp2s0" counter accept
> > iif "lo" accept comment "accept loopback"
> > tcp dport xxxxx counter accept comment "accept SSH"
> > counter log prefix "IPTABLES IN= " level crit flags
tcp
> > sequence,options counter drop comment "count dropped packets"
> > }
> > }
> >
> >
> > After it runs for a few minutes it adds the following at the bottom of
> > the table:
> >
> >
> > table ip filter {
> > chain INPUT {
> > type filter hook input priority filter; policy accept;
> > counter packets 214 bytes 18153 jump block
> > }
> >
> > chain FORWARD {
> > type filter hook forward priority filter; policy accept;
> > counter packets 525 bytes 85145 jump block
> > }
> >
> > chain OUTPUT {
> > type filter hook output priority filter; policy accept;
> > }
> >
> > chain block {
> > }
> > }
> >
> > I can't explain this, can anyone else do so?
> >
> > Thanks,
> >
> > David
> > _______________________________________________
> > users mailing list -- users(a)lists.fedoraproject.org
> > To unsubscribe send an email to users-leave(a)lists.fedoraproject.org
> > Fedora Code of Conduct:
> >
https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List
> > Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines List
> > Archives:
> >
https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.org
>
> maybe something else is running like firewalld? i've been using nftables
> for a while on other distros and now on fedora and i haven't seen any
> changes being made to my nftables.conf.
>
> maybe run "systemctl status firewalld"?
>
I had gone back iptables several times while trying to understand nftables.
For the first several switches this problem did not occur.
The last switch to nftables I ran:
iptables -F and iptables -X
but did not run
rpm -e --nodeps iptables.
I removed iptables and the problem went away but on the nftables wiki it
states:
Question 4. How do nftables and iptables interact when used on the same
system?
What happens when you mix Iptables and Nftables? How do they interact?
nft Empty Accept Accept Block
Blank iptables Empty Empty Block
Accept Accept Results Pass Pass Unreachable
Unreachable Pass
My nftables has been running for hours with no problem.
Thanks for your responses,
David
When I installed on another computer I found out that running
rpm -e --nodeps iptables
is not enough I also had to do
rpm -e --nodeps iptables-services
I did have to keep iptables-libs - without it nft will not run.
After I did that I did not have the extra table added.
David
> _______________________________________________
> users mailing list -- users(a)lists.fedoraproject.org
> To unsubscribe send an email to users-leave(a)lists.fedoraproject.org
> Fedora Code of Conduct:
>
https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List
> Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines List
> Archives:
>
https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.org