Nftables Router Tutorial - Revision history

Digimer at 05:00, 28 March 2024

2024-03-28T05:00:23Z

@@ Line 308: / Line 308: @@
 Complete!
 </syntaxhighlight>
 == Configure the DHCP Service ==
@@ Line 359: / Line 367: @@
 == Configure the DHCP Server ==
-Back up the original config file.
+Edit the DHCP server config file;
 <syntaxhighlight lang="bash">
-cp /etc/dhcp/dhcpd.conf /etc/dhcp/dhcpd.conf.original
+systemctl enable --now dhcpd.service
 </syntaxhighlight>
 <syntaxhighlight lang="text">
 </syntaxhighlight>
 = References =

Digimer at 04:44, 28 March 2024

2024-03-28T04:44:25Z

Show changes

Digimer: /* Setup */

2024-03-28T01:44:29Z

Setup

← Older revision		Revision as of 01:44, 28 March 2024
Line 4:		Line 4:

	This tutorial is meant to show how to use <span class="code">nftables</span> to build a router suitable for a home or boat.		This tutorial is meant to show how to use <span class="code">nftables</span> to build a router suitable for a home or boat.

			This tutorial is written for [[RHEL]] 9 or distros based on it, like [[AlmaLinux]] 9 and [[Rocky Linux]] 9.

	= Setup =		= Setup =

			Before we configure <span class="code">nftables</span>, we need to setup the machine first.

			== Enabling ipv4 Forwarding ==

	Make sure that <span class="code">ip_forward</span> is enabled in the kernel.		Make sure that <span class="code">ip_forward</span> is enabled in the kernel.
Line 55:		Line 61:
	</syntaxhighlight>		</syntaxhighlight>

	Now <span class="code">ip_forward</span> is enabled!		Now <span class="code">ip_forward</span> is enabled!

			== Disable firewalld ==

			The <span class="code">nftables</span> tool is an alternative to <span class="code">firewalld</span>, so we need to disable it.

			<syntaxhighlight lang="bash">
			systemctl disable --now firewalld.service
			</syntaxhighlight>
			<syntaxhighlight lang="text">
			Removed "/etc/systemd/system/multi-user.target.wants/firewalld.service".
			Removed "/etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service".
			</syntaxhighlight>

	= Configuring nftables =		= Configuring nftables =

Digimer at 01:31, 28 March 2024

2024-03-28T01:31:02Z

← Older revision		Revision as of 01:31, 28 March 2024
Line 10:		Line 10:

	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">
	~~cat /proc/sys/~~net/ipv4~~/ip_forward~~		sysctl net.ipv4.conf.all.forwarding
	</syntaxhighlight>		</syntaxhighlight>
	<syntaxhighlight lang="text">		<syntaxhighlight lang="text">
	0		net.ipv4.conf.all.forwarding = 0
	</syntaxhighlight>		</syntaxhighlight>

	This shows that it's disabled. To enable it, ~~write~~ "<span class="code">1</span>" ~~to that virtual file~~		This shows that it's disabled. To enable it, and make sure it's set when the system reboots, edit (or create) the file "<span class="code">/etc/sysctl.d/99-custom.conf</span>" and add (or update) the lines;

	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">
	~~echo 1 > /proc/sys/~~net/ipv4/~~ip_forward~~		# Added for router function support
	~~cat /proc/sys/net/ipv4/ip_forward~~		net.ipv4.conf.all.forwarding = 1
			</syntaxhighlight>

			Now reload the config;

			<syntaxhighlight lang="bash">
			sysctl --system
	</syntaxhighlight>		</syntaxhighlight>
	<syntaxhighlight lang="text">		<syntaxhighlight lang="text">
	1		* Applying /usr/lib/sysctl.d/10-default-yama-scope.conf ...
			* Applying /usr/lib/sysctl.d/50-coredump.conf ...
			* Applying /usr/lib/sysctl.d/50-default.conf ...
			* Applying /usr/lib/sysctl.d/50-libkcapi-optmem_max.conf ...
			* Applying /usr/lib/sysctl.d/50-pid-max.conf ...
			* Applying /usr/lib/sysctl.d/50-redhat.conf ...
			* Applying /etc/sysctl.d/99-custom.conf ...
			* Applying /etc/sysctl.d/99-sysctl.conf ...
			* Applying /etc/sysctl.conf ...
			kernel.yama.ptrace_scope = 0
			kernel.core_pattern = \|/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h
			...<snip>...
			net.ipv4.conf.lo.rp_filter = 1
			net.ipv4.conf.wlp58s0.rp_filter = 1
			net.ipv4.conf.all.forwarding = 1
	</syntaxhighlight>		</syntaxhighlight>

			Now we can verify that forwarding is enabled;

			<syntaxhighlight lang="bash">
			sysctl net.ipv4.conf.all.forwarding
			</syntaxhighlight>
			<syntaxhighlight lang="text">
			net.ipv4.conf.all.forwarding = 1
			</syntaxhighlight>

			Now <span class="code">ip_forward</span> is enabled!

			= Configuring nftables =

Digimer at 01:05, 28 March 2024

2024-03-28T01:05:28Z

← Older revision		Revision as of 01:05, 28 March 2024
Line 5:		Line 5:
	This tutorial is meant to show how to use <span class="code">nftables</span> to build a router suitable for a home or boat.		This tutorial is meant to show how to use <span class="code">nftables</span> to build a router suitable for a home or boat.

			= Setup =

			Make sure that <span class="code">ip_forward</span> is enabled in the kernel.

			<syntaxhighlight lang="bash">
			cat /proc/sys/net/ipv4/ip_forward
			</syntaxhighlight>
			<syntaxhighlight lang="text">
			0
			</syntaxhighlight>

			This shows that it's disabled. To enable it, write "<span class="code">1</span>" to that virtual file

			<syntaxhighlight lang="bash">
			echo 1 > /proc/sys/net/ipv4/ip_forward
			cat /proc/sys/net/ipv4/ip_forward
			</syntaxhighlight>
			<syntaxhighlight lang="text">
			1
			</syntaxhighlight>


	= References =		= References =

	[https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/configuring_firewalls_and_packet_filters/getting-started-with-nftables_firewall-packet-filters Getting started with nftables] - (May required a Red Hat account).		* [https://wiki.nftables.org/wiki-nftables/index.php/Simple_ruleset_for_a_home_router Simple ruleset for a home router] - nftables Wiki
			* [https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/configuring_firewalls_and_packet_filters/getting-started-with-nftables_firewall-packet-filters Getting started with nftables] - (*May required a Red Hat account).

	<span class="code"></span>		<span class="code"></span>
			<syntaxhighlight lang="bash">
			</syntaxhighlight>
			<syntaxhighlight lang="text">
			</syntaxhighlight>

	{{footer}}		{{footer}}

Digimer at 00:34, 28 March 2024

2024-03-28T00:34:25Z

← Older revision		Revision as of 00:34, 28 March 2024
Line 1:		Line 1:
	{{howto_header}}		{{howto_header}}

			{{warning\|1=This is incomplete and untrustworthy! Do not expect anything to be useful or accurate before this warning is removed.}}

	This tutorial is meant to show how to use <span class="code">nftables</span> to build a router suitable for a home or boat.		This tutorial is meant to show how to use <span class="code">nftables</span> to build a router suitable for a home or boat.
Line 9:		Line 11:
	= References =		= References =

	*[https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/configuring_firewalls_and_packet_filters/getting-started-with-nftables_firewall-packet-filters Getting started with nftables] (required a Red Hat account).		[https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/configuring_firewalls_and_packet_filters/getting-started-with-nftables_firewall-packet-filters Getting started with nftables] - (May required a Red Hat account).

	<span class="code"></span>		<span class="code"></span>

	{{footer}}		{{footer}}

Digimer at 00:27, 28 March 2024

2024-03-28T00:27:17Z

← Older revision		Revision as of 00:27, 28 March 2024
Line 9:		Line 9:
	= References =		= References =

	*[~~Getting started with nftables~~ https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/configuring_firewalls_and_packet_filters/getting-started-with-nftables_firewall-packet-filters] (required a Red Hat account).		*[https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/configuring_firewalls_and_packet_filters/getting-started-with-nftables_firewall-packet-filters Getting started with nftables] (required a Red Hat account).

	<span class="code"></span>		<span class="code"></span>

	{{footer}}		{{footer}}

Digimer: Created page with "{{howto_header}} This tutorial is meant to show how to use nftables to build a router suitable for a home or boat. = References = *[Getting started with nftables https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/configuring_firewalls_and_packet_filters/getting-started-with-nftables_firewall-packet-filters] (required a Red Hat account). {{footer}}"

2024-03-28T00:26:56Z

Created page with "{{howto_header}} This tutorial is meant to show how to use nftables to build a router suitable for a home or boat. = References = *[Getting started with nftables https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/configuring_firewalls_and_packet_filters/getting-started-with-nftables_firewall-packet-filters] (required a Red Hat account). {{footer}}"

Páàjì titun

{{howto_header}}

This tutorial is meant to show how to use nftables to build a router suitable for a home or boat.

= References =

*[Getting started with nftables https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/configuring_firewalls_and_packet_filters/getting-started-with-nftables_firewall-packet-filters] (required a Red Hat account).



{{footer}}