nftables | Ansible role to manage Nftables rules and packages | Firewall library

I didn't find similar solution, apart from parsing multiple arguments which is a whole script by it self.
I need to get handle # from nftables for the script, and having problems because it is not always located on the same position. With Iptables it was line number which was always listed on the first field so was very easy to capture insert position. when I do: nft -n -a list chain inet fw4 forward output would be something like this:

In many nftables examples, I sometimes see statement like this:

I am trying to dynamically add a map element using the nftables JSON API from python. In my firewall I have the following map in the router table in the ip family:

My goal is to forward packets from an interface to another interface without source port conflicts using the right feature, NAPT.

I couldn't find how to add a NAPT rule (Network Address Port Translation or also known as PAT) with iptables and nftables.

More interestingly, searching combinations of PAT NAPT iptables/nftables/netfilter doesn't give anything relevant. Even when they mention PAT/NAPT, they do a simple IP masquerading...

It seems iptables's NAT does implicit port translation... somehow it's obvious for everybody even though it isn't written anywhere. The definition of NAT is however pretty clear and doesn't include a layer 4 alteration. Whatever...

I get the ports as a variable and I need to delete the rule in nftables. If the port is present in rule then i would grep the handle number and delete the rule. But in nftables service name would be present in rule so how can I delete the rule. Is there any way to find the what port belongs to service or any other way to delete the nftable rule other than handle or any other suggestions ??

Debian has a package called python3-nftables. You can install it with apt. It lets you interact with nftables (the modern iptables replacement).

Normally, when apt has a Python library, the library can also be found on pypi.org, which means the library can be included in a requirements.txt file, and be installed along with any other Python libraries when the virtual environment is being set up. Unfortunately, as far as I can tell, this package is not available on pypi.org.

If I install it with apt, and run python3, I can import nftables. Great. The problem is that when you enter a virtual environment and try the same thing - import nftables, it won't be found, because by default, the virtual environment ignores any system libraries installed with apt.

You can, of course, tell it to include those with --system-site-packages when creating the virtual environment, but there's a reason this isn't enabled by default.

After installing python3-nftables with apt, I can also copy the package (/usr/lib/python3/dist-packages/nftables) directly into my project folder, and include it in my project's git repo. That works, but seems a bit hackey.

Is there a proper way to install the nftables library inside of the virtual environment, instead of installing it system-wide, and forcing the virtual environment to see it?

I have a cluster with 4 nodes (3 raspi, 1 NUC) and have setup several different workloads. The cluster itself worked perfectly fine, so I doubt that it is a general problem with the configuration. After a reboot of all nodes the cluster came back up well and all pods are running without issues. Unfortunately, pods that are running on one of my nodes (NUC) are not reachable via ingress anymore. If I access them through kube-proxy, I can see that the pods itself run fine and the http services behave as exptected. I upgraded the NUC node from Ubuntu 20.10 from 21.04, which may be related to the issues, but is not confirmed.

When the same pods are scheduled to the other nodes everything works as expected. For pods on the NUC node, I see the following in the ingress-controller logs:

System : RHEL 8.4 Docker Version : 20.10

RHEL 8 has moved from iptables to nftables and Docker inbuild uses iptables to set firewall rules on the machine.

It seems to have break the communication from docker containers to host services, and also to other hosted docker containers on the same network.

I have to communicate to registry hosted in container on port 5000.

And also I am hosting impala services in container and opened exposed following ports

21000

21050

25000

25010

25020

Also when i logged in to container it cannot make contact to internet.

Does anyone know what rules can be set to make proper communications to docker. Also the service hosted in container must be able to contact all the related host services.

Things tried until now :

Made changes in /etc/docker/daemon.json