nftables | repository contains a Go module | Firewall library

by google Go Version: v0.1.0 License: Apache-2.0

X-Ray Key Features Code Snippets Community Discussions(7)Vulnerabilities Install Support

kandi X-RAY | nftables Summary

nftables is a Go library typically used in Security, Firewall applications. nftables has no bugs, it has no vulnerabilities, it has a Permissive License and it has medium support. You can download it from GitHub.

This is not the correct repository for issues with the Linux nftables project! This repository contains a third-party Go package to programmatically interact with nftables. Find the official nftables website at This package manipulates Linux nftables (the iptables successor). It is implemented in pure Go, i.e. does not wrap libnftnl. This is not an official Google product.

Support

Quality

Security

License

Reuse

Support

nftables has a medium active ecosystem.

It has 867 star(s) with 100 fork(s). There are 26 watchers for this library.

It had no major release in the last 6 months.

There are 13 open issues and 83 have been closed. On average issues are closed in 39 days. There are 7 open pull requests and 0 closed requests.

It has a neutral sentiment in the developer community.

The latest version of nftables is v0.1.0

Quality

nftables has no bugs reported.

Security

nftables has no vulnerabilities reported, and its dependent libraries have no vulnerabilities reported.

License

nftables is licensed under the Apache-2.0 License. This license is Permissive.

Permissive licenses have the least restrictions, and you can use them in most projects.

Reuse

nftables releases are not available. You will need to build from source code and install.

Top functions reviewed by kandi - BETA

kandi's functional review helps you automatically verify the functionalities of the libraries and avoid rework.
Currently covering the most popular Java, JavaScript and Python libraries. See a Sample of nftables

Get all kandi verified functions for this library.

nftables Key Features

No Key Features are available at this moment for nftables.

nftables Examples and Code Snippets

No Code Snippets are available at this moment for nftables.

Community Discussions

Trending Discussions on nftables

Issues cross compiling iptables for arm

gcc returns "undefined reference to" function after editing library source code

Is it possible to define variables in a task for a role?

Cannot flush nftable element's set

nftables - IPv6 port knocking - accept whole subnet

install sshuttle in a Google sdk docker image

How do I specify a subnet mask when adding a rule in nftables?

QUESTION

Issues cross compiling iptables for arm

Asked 2020-Aug-17 at 18:34

I am trying to cross compile iptables for ARM. I have tried versions 1.6.1 and 1.8.5 and both have similiar problems. iptables has three dependencies, libmnl, libnftnl and libnfnetlink. I have ensured all these are cross compiled and available in these locations -

...

ANSWER

Answered 2020-Aug-17 at 18:34

This is difficult to say what exactly is causing your issue, but I would say that you may be missing -lnftnl linker option - my two cents.

This being said, I tried to cross-compile libmnl-1.0.4.tar.bz2, libnftnl-1.1.7.tar.bz2 and iptables-1.8.5.tar.bz2 using the following script, and all three compilations did succeed:

build.sh:

Source https://stackoverflow.com/questions/63455706

QUESTION

gcc returns "undefined reference to" function after editing library source code

Asked 2020-Jul-19 at 13:04

I have added a function inside the .c source code of a certain library and added the function header in the corresponding .h file then installed the whole program (./configure ; make ; make install) with no error.
checked with nm if my function was present inside the shared library (.so) (generated by the compilation above) : it said the function was there
when compiling a program calling my custom function and linking it against the library , I get the following error:

...

ANSWER

Answered 2020-Jul-19 at 13:04

The nftables library only makes specific things externally usable. It's accomplished with two mechanisms:

default visibility
mapfiles

A little bit of reading of the source indicates that the documented mechanism for controlling the visibility is a declaration of:

Source https://stackoverflow.com/questions/62979590

QUESTION

Is it possible to define variables in a task for a role?

Asked 2020-Jun-01 at 02:35

I need to include a role in my own role, which relies on variables being set. Can I include them in a task and will they be applied to that included role?

Something like this:

...

ANSWER

Answered 2020-May-31 at 22:10

You can pass a variable with include_role as shown below according to the documentation:

Source https://stackoverflow.com/questions/62121908

QUESTION

Cannot flush nftable element's set

Asked 2020-Apr-30 at 12:11

I am actually learning to use nftables on a test environment and I'm actually working with nftables sets. I was on version 0.7 and since my tests weren't working I updated to 0.9.4 version but my problem was still the same.

I can create my sets on my table without any problems. And my set elements must contain ipv4 adresses. I worked with nftables tables, chains and sets without problems, my rules worked etc...

So what I want to do but can't find how to do it is to delete all my set's elements without precising the ipv4 addresses one by one.

Let's say my table's name is test and my set name's is tmp with an ipv4_addr type, my configuration will looks like that:

...

ANSWER

Answered 2020-Apr-30 at 12:11

So I contacted the netfilter team and gave me an answer.

The flush option for a set only works from Linux 4.10 onwards and my version was below.

I found a way to flush the table anyway with these commands on Debian if you are interested:

Store the elements from the set in variable:

Source https://stackoverflow.com/questions/61252260

QUESTION

nftables - IPv6 port knocking - accept whole subnet

Asked 2020-Apr-27 at 19:51

I'd like to add port knocking to a server which is already working. My client sends the magic sequence of packets and the server will add it to a nftables set of allowed clients for specific time. Therefor the clients are allowed to use some services. For details see my configuration below.

Now I want to do the port knocking automatically from my router. For IPv4 this works, but for IPv6 this doesn't work because there is no NAT involved so each client has a unique address. That's why I'd like to add the whole subnet (/56) of the knocking client the set of allowed clients.

Is this possible using nftables? I've read about "flags interval" but I don't understand how to dynamically add the clients subnet to it.

...

ANSWER

Answered 2020-Apr-27 at 19:51

After a successful port knock don't add the source ip of the client but mask it using port_knock_netmask_v6. When checking if a new connection originates from a client after successful knock also mask it using port_knock_netmask_v6.

Source https://stackoverflow.com/questions/61238123

QUESTION

install sshuttle in a Google sdk docker image

Asked 2020-Apr-02 at 16:34

I am struggling to build this baby Dockerfile:

...

ANSWER

Answered 2020-Apr-02 at 14:34

Your Docker DNS could be breaking index file resolution. Try using docker build --network=host

Source https://stackoverflow.com/questions/60993747

QUESTION

How do I specify a subnet mask when adding a rule in nftables?