Configuring firewalls and packet filters

Procedure

1. List the available firewall zones:

   # firewall-cmd --get-zones

   Copy to Clipboard Toggle word wrap

   The firewall-cmd --get-zones command displays all zones that are available on the system, but it does not show any details for particular zones. To see more detailed information for all zones, use the firewall-cmd --list-all-zones command.

2. Choose the zone you want to use for this configuration.

3. Modify firewall settings for the chosen zone. For example, to allow the SSH service and remove the ftp service:

   # firewall-cmd --add-service=ssh --zone=<your_chosen_zone>
   # firewall-cmd --remove-service=ftp --zone=<same_chosen_zone>

   Copy to Clipboard Toggle word wrap

4. Assign a network interface to the firewall zone:

   1. List the available network interfaces:

      # firewall-cmd --get-active-zones

      Copy to Clipboard Toggle word wrap

      Activity of a zone is determined by the presence of network interfaces or source address ranges that match its configuration. The default zone is active for unclassified traffic but is not always active if no traffic matches its rules.

   2. Assign a network interface to the chosen zone:

      # firewall-cmd --zone=<your_chosen_zone> --change-interface=<interface_name> --permanent

      Copy to Clipboard Toggle word wrap

      Assigning a network interface to a zone is more suitable for applying consistent firewall settings to all traffic on a particular interface (physical or virtual).

      The firewall-cmd command, when used with the --permanent option, often involves updating NetworkManager connection profiles to make changes to the firewall configuration permanent. This integration between firewalld and NetworkManager ensures consistent network and firewall settings.

Verification

1. Display the updated settings for your chosen zone:

   # firewall-cmd --zone=<your_chosen_zone> --list-all

   Copy to Clipboard Toggle word wrap

   The command output displays all zone settings including the assigned services, network interface, and network connections (sources).

Procedure

1. Display the current default zone:

   # firewall-cmd --get-default-zone

   Copy to Clipboard Toggle word wrap

2. Set the new default zone:

   # firewall-cmd --set-default-zone <zone_name>

   Copy to Clipboard Toggle word wrap
   Note

   Following this procedure, the setting is a permanent setting, even without the --permanent option.

Procedure

1. List the active zones and the interfaces assigned to them:

   # firewall-cmd --get-active-zones

   Copy to Clipboard Toggle word wrap

2. Assign the interface to a different zone:

   # firewall-cmd --zone=zone_name --change-interface=interface_name --permanent

   Copy to Clipboard Toggle word wrap

Procedure

1. List all available zones:

   # firewall-cmd --get-zones

   Copy to Clipboard Toggle word wrap

2. Add the source IP to the trusted zone in the permanent mode:

   # firewall-cmd --zone=trusted --add-source=192.168.2.15

   Copy to Clipboard Toggle word wrap

3. Make the new settings persistent:

   # firewall-cmd --runtime-to-permanent

   Copy to Clipboard Toggle word wrap

Procedure

1. List allowed sources for the required zone:

   # firewall-cmd --zone=zone-name --list-sources

   Copy to Clipboard Toggle word wrap

2. Remove the source from the zone permanently:

   # firewall-cmd --zone=zone-name --remove-source=<source>

   Copy to Clipboard Toggle word wrap

3. Make the new settings persistent:

   # firewall-cmd --runtime-to-permanent

   Copy to Clipboard Toggle word wrap

Procedure

1. Assign the zone to the NetworkManager connection profile:

   # nmcli connection modify profile connection.zone zone_name

   Copy to Clipboard Toggle word wrap

2. Activate the connection:

   # nmcli connection up profile

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a new zone:

   # firewall-cmd --permanent --new-zone=zone-name

   Copy to Clipboard Toggle word wrap

2. Make the new zone usable:

   # firewall-cmd --reload

   Copy to Clipboard Toggle word wrap

   The command applies recent changes to the firewall configuration without interrupting network services that are already running.

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. Click Networking.

3. Click the Edit rules and zones button.

   

   View larger image

   

   If you do not see the Edit rules and zones button, log in to the web console with the administrator privileges.

4. In the Firewall section, click Add new zone.

5. In the Add zone dialog box, select a zone from the Trust level options.

   The web console displays all zones predefined in the firewalld service.

6. In the Interfaces part, select an interface or interfaces to which you want to apply the selected zone.

7. In the Allowed Addresses part, you can select whether the zone is applied to:

   • the whole subnet

   • a range of IP addresses in the following format:

     • 192.168.1.0
     • 192.168.1.0/24
     • 192.168.1.0/24, 192.168.1.0

8. Click the Add zone button.

   

   View larger image

   

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. Click Networking.

3. Click the Edit rules and zones button.

   

   View larger image

   

   If you do not see the Edit rules and zones button, log in to the web console with the administrator privileges.

4. Click the Options icon at the zone you want to remove.

   

   View larger image

   
5. Click Delete.

Procedure

1. List the information for the specific zone to see the default target:

   # firewall-cmd --zone=zone-name --list-all

   Copy to Clipboard Toggle word wrap

2. Set a new target in the zone:

   # firewall-cmd --permanent --zone=zone-name --set-target=<default|ACCEPT|REJECT|DROP>

   Copy to Clipboard Toggle word wrap

Procedure

1. Create an IP set with a meaningful name:

   # firewall-cmd --permanent --new-ipset=allowlist --type=hash:ip

   Copy to Clipboard Toggle word wrap

   The new IP set called allowlist contains IP addresses that you want your firewall to allow.

2. Add a dynamic update to the IP set:

   # firewall-cmd --permanent --ipset=allowlist --add-entry=198.51.100.10

   Copy to Clipboard Toggle word wrap

   This configuration updates the allowlist IP set with a newly added IP address that is allowed to pass network traffic by your firewall.

3. Create a firewall rule that references the previously created IP set:

   # firewall-cmd --permanent --zone=public --add-source=ipset:allowlist

   Copy to Clipboard Toggle word wrap

   Without this rule, the IP set would not have any impact on network traffic. The default firewall policy would prevail.

4. Reload the firewall configuration to apply the changes:

   # firewall-cmd --reload

   Copy to Clipboard Toggle word wrap

Verification

1. List all IP sets:

   # firewall-cmd --get-ipsets
   allowlist

   Copy to Clipboard Toggle word wrap

2. List the active rules:

   # firewall-cmd --list-all
   public (active)
     target: default
     icmp-block-inversion: no
     interfaces: enp0s1
     sources: ipset:allowlist
     services: cockpit dhcpv6-client ssh
     ports:
     protocols:
     ...

   Copy to Clipboard Toggle word wrap

   The sources section of the command-line output provides insights to what origins of traffic (hostnames, interfaces, IP sets, subnets, and others) are permitted or denied access to a particular firewall zone. In this case, the IP addresses contained in the allowlist IP set are allowed to pass traffic through the firewall for the public zone.

3. Explore the contents of your IP set:

   # cat /etc/firewalld/ipsets/allowlist.xml
   <?xml version="1.0" encoding="utf-8"?>
   <ipset type="hash:ip">
     <entry>198.51.100.10</entry>
   </ipset>

   Copy to Clipboard Toggle word wrap

Procedure

1. Check that the service in firewalld is not already allowed:

   # firewall-cmd --list-services
   ssh dhcpv6-client

   Copy to Clipboard Toggle word wrap

   The command lists the services that are enabled in the default zone.

2. List all predefined services in firewalld:

   # firewall-cmd --get-services
   RH-Satellite-6 amanda-client amanda-k5-client bacula bacula-client bitcoin bitcoin-rpc bitcoin-testnet bitcoin-testnet-rpc ceph ceph-mon cfengine condor-collector ctdb dhcp dhcpv6 dhcpv6-client dns docker-registry ...

   Copy to Clipboard Toggle word wrap

   The command displays a list of available services for the default zone.

3. Add the service to the list of services that firewalld allows:

   # firewall-cmd --add-service=<service_name>

   Copy to Clipboard Toggle word wrap

   The command adds the specified service to the default zone.

4. Make the new settings persistent:

   # firewall-cmd --runtime-to-permanent

   Copy to Clipboard Toggle word wrap

   The command applies these runtime changes to the permanent configuration of the firewall. By default, it applies these changes to the configuration of the default zone.

Verification

1. List all permanent firewall rules:

   # firewall-cmd --list-all --permanent
   public
     target: default
     icmp-block-inversion: no
     interfaces:
     sources:
     services: cockpit dhcpv6-client ssh
     ports:
     protocols:
     forward: no
     masquerade: no
     forward-ports:
     source-ports:
     icmp-blocks:
     rich rules:

   Copy to Clipboard Toggle word wrap

   The command displays complete configuration with the permanent firewall rules of the default firewall zone (public).

2. Check the validity of the permanent configuration of the firewalld service.

   # firewall-cmd --check-config
   success

   Copy to Clipboard Toggle word wrap

   If the permanent configuration is invalid, the command returns an error with further details:

   # firewall-cmd --check-config
   Error: INVALID_PROTOCOL: 'public.xml': 'tcpx' not from {'tcp'|'udp'|'sctp'|'dccp'}

   Copy to Clipboard Toggle word wrap

   You can also manually inspect the permanent configuration files to verify the settings. The main configuration file is /etc/firewalld/firewalld.conf. The zone-specific configuration files are in the /etc/firewalld/zones/ directory and the policies are in the /etc/firewalld/policies/ directory.

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. Click Networking.

3. Click the Edit rules and zones button.

   

   View larger image

   

   If you do not see the Edit rules and zones button, log in to the web console with the administrator privileges.

4. In the Firewall section, select a zone for which you want to add the service and click Add Services.

   

   View larger image

   
5. In the Add Services dialog box, find the service you want to enable in the firewall.

6. Enable services according to your scenario:

   

   View larger image

   
7. Click Add Services.

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. Click Networking.

3. Click the Edit rules and zones button.

   

   View larger image

   

   If you do not see the Edit rules and zones button, log in to the web console with the administrative privileges.

4. In the Firewall section, select a zone for which you want to configure a custom port and click Add Services.

   

   View larger image

   
5. In the Add services dialog box, click the Custom Ports radio button.

6. In the TCP and UDP fields, add ports according to examples. You can add ports in the following formats:

   • Port numbers such as 22
   • Range of port numbers such as 5900-5910
   • Aliases such as nfs, rsync
   Note

   You can add multiple values into each field. You must separate values with a comma and without a space, for example: 8080,8081,http

7. After adding the port number in the TCP field, the UDP field, or both, verify the service name in the Name field.

   The Name field displays the name of the service for which this port is reserved. You can rewrite the name if you are sure that this port is free to use and no server requires it to communicate on this port.

8. In the Name field, add a name for the service including defined ports.

9. Click the Add Ports button.

   

   View larger image

   

Procedure

1. Create a new firewall policy:

   # firewall-cmd --permanent --new-policy podmanToAny

   Copy to Clipboard Toggle word wrap

2. Block all traffic from Podman to other zones and allow only necessary services on Podman:

   # firewall-cmd --permanent --policy podmanToAny --set-target REJECT
   # firewall-cmd --permanent --policy podmanToAny --add-service dhcp
   # firewall-cmd --permanent --policy podmanToAny --add-service dns
   # firewall-cmd --permanent --policy podmanToAny --add-service https

   Copy to Clipboard Toggle word wrap

3. Create a new Podman zone:

   # firewall-cmd --permanent --new-zone=podman

   Copy to Clipboard Toggle word wrap

4. Define the ingress zone for the policy:

   # firewall-cmd --permanent --policy podmanToHost --add-ingress-zone podman

   Copy to Clipboard Toggle word wrap

5. Define the egress zone for all other zones:

   # firewall-cmd --permanent --policy podmanToHost --add-egress-zone ANY

   Copy to Clipboard Toggle word wrap

   Setting the egress zone to ANY means that you filter from Podman to other zones. If you want to filter to the host, then set the egress zone to HOST.

6. Restart the firewalld service:

   # systemctl restart firewalld

   Copy to Clipboard Toggle word wrap

Procedure

1. To check if IP masquerading is enabled (for example, for the external zone), enter the following command as root:

   # firewall-cmd --zone=external --query-masquerade

   Copy to Clipboard Toggle word wrap

   The command prints yes with exit status 0 if enabled. It prints no with exit status 1 otherwise. If zone is omitted, the default zone will be used.

2. To enable IP masquerading, enter the following command as root:

   # firewall-cmd --zone=external --add-masquerade

   Copy to Clipboard Toggle word wrap
3. To make this setting persistent, pass the --permanent option to the command.

4. To disable IP masquerading, enter the following command as root:

   # firewall-cmd --zone=external --remove-masquerade

   Copy to Clipboard Toggle word wrap

   To make this setting permanent, pass the --permanent option to the command.

Procedure

1. Forward incoming HTTP traffic:

   # firewall-cmd --zone=public --add-forward-port=port=80:proto=tcp:toaddr=198.51.100.10:toport=8080 --permanent

   Copy to Clipboard Toggle word wrap

   The previous command defines a DNAT rule with the following settings:

   • --zone=public - The firewall zone for which you configure the DNAT rule. You can adjust this to whatever zone you need.
   • --add-forward-port - The option that indicates you are adding a port-forwarding rule.
   • port=80 - The external destination port.
   • proto=tcp - The protocol indicating that you forward TCP traffic.
   • toaddr=198.51.100.10 - The destination IP address.
   • toport=8080 - The destination port of the internal server.
   • --permanent - The option that makes the DNAT rule persistent across reboots.

2. Reload the firewall configuration to apply the changes:

   # firewall-cmd --reload

   Copy to Clipboard Toggle word wrap

Procedure

1. Create the NAT redirect rule:

   # firewall-cmd --zone=public --add-forward-port=port=<standard_port>:proto=tcp:toport=<non_standard_port> --permanent

   Copy to Clipboard Toggle word wrap

   The previous command defines the NAT redirect rule with the following settings:

   • --zone=public - The firewall zone, for which you configure the rule. You can adjust this to whatever zone you need.
   • --add-forward-port=port=<non_standard_port> - The option that indicates you are adding a port-forwarding (redirecting) rule with source port on which you initially receive the incoming traffic.
   • proto=tcp - The protocol indicating that you redirect TCP traffic.
   • toport=<standard_port> - The destination port, to which the incoming traffic should be redirected after being received on the source port.
   • --permanent - The option that makes the rule persist across reboots.

2. Reload the firewall configuration to apply the changes:

   # firewall-cmd --reload

   Copy to Clipboard Toggle word wrap

Procedure

1. Enable packet forwarding in the kernel:

   # echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf
   # sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf

   Copy to Clipboard Toggle word wrap

2. Ensure that interfaces between which you want to enable intra-zone forwarding are assigned only to the internal zone:

   # firewall-cmd --get-active-zones

   Copy to Clipboard Toggle word wrap

3. If the interface is currently assigned to a zone other than internal, reassign it:

   # firewall-cmd --zone=internal --change-interface=interface_name --permanent

   Copy to Clipboard Toggle word wrap

4. Add the enp1s0 and wlp0s20 interfaces to the internal zone:

   # firewall-cmd --zone=internal --add-interface=enp1s0 --add-interface=wlp0s20

   Copy to Clipboard Toggle word wrap

5. Enable intra-zone forwarding:

   # firewall-cmd --zone=internal --add-forward

   Copy to Clipboard Toggle word wrap

Verification

1. Log in to a host that is on the same network as the enp1s0 interface of the host on which you enabled zone forwarding.

2. Start an echo service with ncat to test connectivity:

   # ncat -e /usr/bin/cat -l 12345

   Copy to Clipboard Toggle word wrap
3. Log in to a host that is in the same network as the wlp0s20 interface.

4. Connect to the echo server running on the host that is in the same network as the enp1s0:

   # ncat <other_host> 12345

   Copy to Clipboard Toggle word wrap
5. Type something and press Enter. Verify the text is sent back.

Procedure

1. Create a playbook file, for example, ~/playbook.yml, with the following content:

   ---
   - name: Reset firewalld example
     hosts: managed-node-01.example.com
     tasks:
       - name: Reset firewalld
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.firewall
         vars:
           firewall:
             - previous: replaced

   Copy to Clipboard Toggle word wrap

   The settings specified in the example playbook include the following:

   previous: replaced

   Removes all existing user-defined settings and resets the firewalld settings to defaults. If you combine the previous:replaced parameter with other settings, the firewall role removes all existing settings before applying new ones.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.firewall/README.md file on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Copy to Clipboard Toggle word wrap

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a playbook file, for example, ~/playbook.yml, with the following content:

   ---
   - name: Configure firewalld
     hosts: managed-node-01.example.com
     tasks:
       - name: Forward incoming traffic on port 8080 to 443
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.firewall
         vars:
           firewall:
             - forward_port: 8080/tcp;443;
               state: enabled
               runtime: true
               permanent: true

   Copy to Clipboard Toggle word wrap

   The settings specified in the example playbook include the following:

   forward_port: 8080/tcp;443

   Traffic coming to the local port 8080 using the TCP protocol is forwarded to port 443.

   runtime: true

   Enables changes in the runtime configuration. The default is set to true.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.firewall/README.md file on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Copy to Clipboard Toggle word wrap

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a playbook file, for example, ~/playbook.yml, with the following content:

   ---
   - name: Configure firewalld
     hosts: managed-node-01.example.com
     tasks:
       - name: Creating a DMZ with access to HTTPS port and masquerading for hosts in DMZ
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.firewall
         vars:
           firewall:
             - zone: dmz
               interface: enp1s0
               service: https
               state: enabled
               runtime: true
               permanent: true

   Copy to Clipboard Toggle word wrap

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.firewall/README.md file on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Copy to Clipboard Toggle word wrap

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - name: Configure firewalld
     hosts: managed-node-01.example.com
     tasks:
       - name: Create a firewalld service
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.firewall
         vars:
           firewall:
             service: custom_service
             short: A custom firewalld service
             description: >-
               A custom firewalld service that opens port 2222/tcp and
               the ports opened by the http and https firewalld services.
             port: 2222/tcp
             includes:
               - http
               - https
             state: present
             permanent: true

   Copy to Clipboard Toggle word wrap

   The settings specified in the example playbook include the following:

   service: <service_name>

   Sets the name of the service.

   short: <short_description>

   Sets a short description for the service.

   description: <description>

   Sets a long description for the service.

   port: <port>/<protocol>

   Defines the ports and protocols the service file should allow. To define multiple entries, use a YAML list.

   includes: <services>

   Optional: Defines other firewalld service files the service you want to create should include.

   state: present

   Adds the service. If the service already exists, the role modifies it as defined.

   permanent: true

   Enables changes in the permanent configuration of firewalld.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.firewall/README.md file on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Copy to Clipboard Toggle word wrap

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a table named nftables_svc with the inet address family so that the table can process both IPv4 and IPv6 packets:

   # nft add table inet nftables_svc

   Copy to Clipboard Toggle word wrap

2. Add a base chain named INPUT, that processes incoming network traffic, to the inet nftables_svc table:

   # nft add chain inet nftables_svc INPUT { type filter hook input priority filter \; policy accept \; }

   Copy to Clipboard Toggle word wrap

   To avoid that the shell interprets the semicolons as the end of the command, escape the semicolons using the \ character.

3. Add rules to the INPUT chain. For example, allow incoming TCP traffic on port 22 and 443, and, as the last rule of the INPUT chain, reject other incoming traffic with an Internet Control Message Protocol (ICMP) port unreachable message:

   # nft add rule inet nftables_svc INPUT tcp dport 22 accept
   # nft add rule inet nftables_svc INPUT tcp dport 443 accept
   # nft add rule inet nftables_svc INPUT reject with icmpx type port-unreachable

   Copy to Clipboard Toggle word wrap

   If you enter the nft add rule commands as shown, nft adds the rules in the same order to the chain as you run the commands.

4. Display the current rule set including handles:

   # nft -a list table inet nftables_svc
   table inet nftables_svc { # handle 13
     chain INPUT { # handle 1
       type filter hook input priority filter; policy accept;
       tcp dport 22 accept # handle 2
       tcp dport 443 accept # handle 3
       reject # handle 4
     }
   }

   Copy to Clipboard Toggle word wrap

5. Insert a rule before the existing rule with handle 3. For example, to insert a rule that allows TCP traffic on port 636, enter:

   # nft insert rule inet nftables_svc INPUT position 3 tcp dport 636 accept

   Copy to Clipboard Toggle word wrap

6. Append a rule after the existing rule with handle 3. For example, to insert a rule that allows TCP traffic on port 80, enter:

   # nft add rule inet nftables_svc INPUT position 3 tcp dport 80 accept

   Copy to Clipboard Toggle word wrap

7. Display the rule set again with handles. Verify that the later added rules have been added to the specified positions:

   # nft -a list table inet nftables_svc
   table inet nftables_svc { # handle 13
     chain INPUT { # handle 1
       type filter hook input priority filter; policy accept;
       tcp dport 22 accept # handle 2
       tcp dport 636 accept # handle 5
       tcp dport 443 accept # handle 3
       tcp dport 80 accept # handle 6
       reject # handle 4
     }
   }

   Copy to Clipboard Toggle word wrap

8. Remove the rule with handle 6:

   # nft delete rule inet nftables_svc INPUT handle 6

   Copy to Clipboard Toggle word wrap

   To remove a rule, you must specify the handle.

9. Display the rule set, and verify that the removed rule is no longer present:

   # nft -a list table inet nftables_svc
   table inet nftables_svc { # handle 13
     chain INPUT { # handle 1
       type filter hook input priority filter; policy accept;
       tcp dport 22 accept # handle 2
       tcp dport 636 accept # handle 5
       tcp dport 443 accept # handle 3
       reject # handle 4
     }
   }

   Copy to Clipboard Toggle word wrap

10. Remove all remaining rules from the INPUT chain:

    # nft flush chain inet nftables_svc INPUT

    Copy to Clipboard Toggle word wrap

11. Display the rule set, and verify that the INPUT chain is empty:

    # nft list table inet nftables_svc
    table inet nftables_svc {
      chain INPUT {
        type filter hook input priority filter; policy accept
      }
    }

    Copy to Clipboard Toggle word wrap

12. Delete the INPUT chain:

    # nft delete chain inet nftables_svc INPUT

    Copy to Clipboard Toggle word wrap

    You can also use this command to delete chains that still contain rules.

13. Display the rule set, and verify that the INPUT chain has been deleted:

    # nft list table inet nftables_svc
    table inet nftables_svc {
    }

    Copy to Clipboard Toggle word wrap

14. Delete the nftables_svc table:

    # nft delete table inet nftables_svc

    Copy to Clipboard Toggle word wrap

    You can also use this command to delete tables that still contain chains.

    Note

    To delete the entire rule set, use the nft flush ruleset command instead of manually deleting all rules, chains, and tables in separate commands.

Procedure

1. Write the iptables and ip6tables rules to a file:

   # iptables-save >/root/iptables.dump
   # ip6tables-save >/root/ip6tables.dump

   Copy to Clipboard Toggle word wrap

2. Convert the dump files to nftables instructions:

   # iptables-restore-translate -f /root/iptables.dump > /etc/nftables/ruleset-migrated-from-iptables.nft
   # ip6tables-restore-translate -f /root/ip6tables.dump > /etc/nftables/ruleset-migrated-from-ip6tables.nft

   Copy to Clipboard Toggle word wrap
3. Review and, if needed, manually update the generated nftables rules.

4. To enable the nftables service to load the generated files, add the following to the /etc/sysconfig/nftables.conf file:

   include "/etc/nftables/ruleset-migrated-from-iptables.nft"
   include "/etc/nftables/ruleset-migrated-from-ip6tables.nft"

   Copy to Clipboard Toggle word wrap

5. Stop and disable the iptables service:

   # systemctl disable --now iptables

   Copy to Clipboard Toggle word wrap

   If you used a custom script to load the iptables rules, ensure that the script no longer starts automatically and reboot to flush all tables.

6. Enable and start the nftables service:

   # systemctl enable --now nftables

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a table:

   # nft add table nat

   Copy to Clipboard Toggle word wrap

2. Add the prerouting and postrouting chains to the table:

   # nft add chain nat postrouting { type nat hook postrouting priority 100 \; }

   Copy to Clipboard Toggle word wrap
   Important

   Even if you do not add a rule to the prerouting chain, the nftables framework requires this chain to match incoming packet replies.

   Note that you must pass the -- option to the nft command to prevent the shell from interpreting the negative priority value as an option of the nft command.

3. Add a rule to the postrouting chain that matches outgoing packets on the ens3 interface:

   # nft add rule nat postrouting oifname "ens3" masquerade

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a table:

   # nft add table nat

   Copy to Clipboard Toggle word wrap

2. Add the prerouting and postrouting chains to the table:

   # nft add chain nat postrouting { type nat hook postrouting priority 100 \; }

   Copy to Clipboard Toggle word wrap
   Important

   Even if you do not add a rule to the postrouting chain, the nftables framework requires this chain to match outgoing packet replies.

   Note that you must pass the -- option to the nft command to prevent the shell from interpreting the negative priority value as an option of the nft command.

3. Add a rule to the postrouting chain that replaces the source IP of outgoing packets through ens3 with 192.0.2.1:

   # nft add rule nat postrouting oifname "ens3" snat to 192.0.2.1

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a table:

   # nft add table nat

   Copy to Clipboard Toggle word wrap

2. Add the prerouting and postrouting chains to the table:

   # nft -- add chain nat prerouting { type nat hook prerouting priority -100 \; }
   # nft add chain nat postrouting { type nat hook postrouting priority 100 \; }

   Copy to Clipboard Toggle word wrap
   Important

   Even if you do not add a rule to the postrouting chain, the nftables framework requires this chain to match outgoing packet replies.

   Note that you must pass the -- option to the nft command to prevent the shell from interpreting the negative priority value as an option of the nft command.

3. Add a rule to the prerouting chain that redirects incoming traffic to port 80 and 443 on the ens3 interface of the router to the web server with the IP address 192.0.2.1:

   # nft add rule nat prerouting iifname ens3 tcp dport { 80, 443 } dnat to 192.0.2.1

   Copy to Clipboard Toggle word wrap

4. Depending on your environment, add either a SNAT or masquerading rule to change the source address for packets returning from the web server to the sender:

   1. If the ens3 interface uses a dynamic IP addresses, add a masquerading rule:

      # nft add rule nat postrouting oifname "ens3" masquerade

      Copy to Clipboard Toggle word wrap

   2. If the ens3 interface uses a static IP address, add a SNAT rule. For example, if the ens3 uses the 198.51.100.1 IP address:

      # nft add rule nat postrouting oifname "ens3" snat to 198.51.100.1

      Copy to Clipboard Toggle word wrap

5. Enable packet forwarding:

   # echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf
   # sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a table:

   # nft add table nat

   Copy to Clipboard Toggle word wrap

2. Add the prerouting chain to the table:

   # nft -- add chain nat prerouting { type nat hook prerouting priority -100 \; }

   Copy to Clipboard Toggle word wrap

   Note that you must pass the -- option to the nft command to prevent the shell from interpreting the negative priority value as an option of the nft command.

3. Add a rule to the prerouting chain that redirects incoming traffic on port 22 to port 2222:

   # nft add rule nat prerouting tcp dport 22 redirect to 2222

   Copy to Clipboard Toggle word wrap

Procedure

1. Edit the /etc/sysconfig/nftables.conf file.

   • If you modified the *.nft scripts that were created in /etc/nftables/ with the installation of the nftables package, uncomment the include statement for these scripts.

   • If you wrote new scripts, add include statements to include these scripts. For example, to load the /etc/nftables/example.nft script when the nftables service starts, add:

     include "/etc/nftables/_example_.nft"

     Copy to Clipboard Toggle word wrap

2. Optional: Start the nftables service to load the firewall rules without rebooting the system:

   # systemctl start nftables

   Copy to Clipboard Toggle word wrap

3. Enable the nftables service.

   # systemctl enable nftables

   Copy to Clipboard Toggle word wrap

Procedure

1. For example, to add a rule to example_chain in example_table that allows incoming traffic to port 22, 80, and 443:

   # nft add rule inet example_table example_chain tcp dport { 22, 80, 443 } accept

   Copy to Clipboard Toggle word wrap

2. Optional: Display all chains and their rules in example_table:

   # nft list table inet example_table
   table inet example_table {
     chain example_chain {
       type filter hook input priority filter; policy accept;
       tcp dport { ssh, http, https } accept
     }
   }

   Copy to Clipboard Toggle word wrap

Procedure

1. Create an empty set. The following examples create a set for IPv4 addresses:

   • To create a set that can store multiple individual IPv4 addresses:

     # nft add set inet example_table example_set { type ipv4_addr \; }

     Copy to Clipboard Toggle word wrap

   • To create a set that can store IPv4 address ranges:

     # nft add set inet example_table example_set { type ipv4_addr \; flags interval \; }

     Copy to Clipboard Toggle word wrap
   Important

   To prevent the shell from interpreting the semicolons as the end of the command, you must escape the semicolons with a backslash.

2. Optional: Create rules that use the set. For example, the following command adds a rule to the example_chain in the example_table that will drop all packets from IPv4 addresses in example_set.

   # nft add rule inet example_table example_chain ip saddr @example_set drop

   Copy to Clipboard Toggle word wrap

   Because example_set is still empty, the rule has currently no effect.

3. Add IPv4 addresses to example_set:

   • If you create a set that stores individual IPv4 addresses, enter:

     # nft add element inet example_table example_set { 192.0.2.1, 192.0.2.2 }

     Copy to Clipboard Toggle word wrap

   • If you create a set that stores IPv4 ranges, enter:

     # nft add element inet example_table example_set { 192.0.2.0-192.0.2.255 }

     Copy to Clipboard Toggle word wrap

     When you specify an IP address range, you can alternatively use the Classless Inter-Domain Routing (CIDR) notation, such as 192.0.2.0/24 in the above example.