LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 11-23-2015, 01:07 PM   #1
joni1101
LQ Newbie
 
Registered: Nov 2014
Location: Vancouver, BC
Distribution: Debian / SolydK (KDE)
Posts: 2

Rep: Reputation: Disabled
nftables and VPN


I'm trying to switch over from iptables based FW to nftables.

I have a basic ruleset
flush ruleset
table inet filter {
chain input {
type filter hook input priority 0;
ip protocol icmp limit rate 10/second accept
ip protocol icmp drop
ip6 nexthdr icmpv6 limit rate 10/second accept
ip6 nexthdr icmpv6 drop
iif lo accept
ct state established,related accept
ct state invalid drop
tcp dport { 22 } ct state new accept
ip6 nexthdr icmpv6 icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept
counter drop
but it does not allow me to initiate VPN with a vpn provider (i'm the client, so I initiate the connection).

I suspect it has something to do with virtual interface ppp0 being given an int reference by the kernel when it is created - and - we don't know what that int will be until we instantiate vpn. Thus if we tell nftables about if ppp0 it will not know what to do with it nftables is instantiated before vpn - thus ppp0 will be null.

The same behavior is observed with openvpn, where a virtual interface 'tun0' is created by the kernel.

Any guidance would be really valuable.

Thank you

Last edited by joni1101; 11-30-2015 at 05:22 PM. Reason: added openvpn results
 
Old 11-30-2015, 04:03 AM   #2
Skaperen
Senior Member
 
Registered: May 2009
Location: center of singularity
Distribution: Xubuntu, Ubuntu, Slackware, Amazon Linux, OpenBSD, LFS (on Sparc_32 and i386)
Posts: 2,685
Blog Entries: 31

Rep: Reputation: 176Reputation: 176
what VPN type are you using? i would avoid pppd completely if i could (and by running my own VPNs i can ... no pppds in any of my 38 VPNs)

Last edited by Skaperen; 11-30-2015 at 04:06 AM.
 
Old 11-30-2015, 05:22 PM   #3
joni1101
LQ Newbie
 
Registered: Nov 2014
Location: Vancouver, BC
Distribution: Debian / SolydK (KDE)
Posts: 2

Original Poster
Rep: Reputation: Disabled
Hi

I will edit my post to include your suggestion about using OPENVPN. In brief, using openvpn under debian creates a virtual interface, tun0. The exact same behavior is observed. Syslog shows that the openvpn client receives response from the server but then cannot connect.

Disable nftables allows it to connect.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
nftables router MSS serafean Linux - Networking 0 12-24-2014 03:48 PM
[SOLVED] translation from iptables to nftables kikilinux Linux - Security 3 12-17-2014 02:12 PM
LXer: Why you will love nftables LXer Syndicated Linux News 0 01-21-2014 12:42 PM
LXer: Why you will love nftables LXer Syndicated Linux News 0 01-21-2014 08:50 AM
LXer: Linux: First Release Of nftables LXer Syndicated Linux News 0 04-02-2010 06:00 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 03:27 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration