LinuxQuestions.org
Visit Jeremy's Blog.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 11-02-2017, 08:12 AM   #1
jac1
LQ Newbie
 
Registered: Nov 2017
Posts: 3

Rep: Reputation: Disabled
why is nftables 'iifname' not matching but 'iif' is, GNU Linux 4.9.59.


In GNU/Linux 4.9.59, my existing nftables filters which match on iifname do not get matched. If I change the rule to 'iif' it works, but I don't want that because my interface may not exist at the time of rule creation.
For example:
nft add rule ip filter input iifname "myInterface" counter accept

Also the following doesn't work:
nft add rule ip filter input meta iifname "myInterface" counter accept

both successfully create the following rule, which doesn't work:
iifname "myInterface" counter packets 0 bytes 0 accept

Packets received on the interface do not get counted under this rule, but they do enter the input chain (I have as the first line of the input chain "counter packets 0 bytes 0", ie not match criteria).

If I use 'iif', it matches.

What happened? Do I need to load a module by hand?
thanks!
 
Old 11-05-2017, 05:48 AM   #2
smallpond
Senior Member
 
Registered: Feb 2011
Location: Massachusetts, USA
Distribution: Fedora
Posts: 4,140

Rep: Reputation: 1263Reputation: 1263Reputation: 1263Reputation: 1263Reputation: 1263Reputation: 1263Reputation: 1263Reputation: 1263Reputation: 1263
I think that the interface must exist at the time that the rules are compiled into their internal form.
 
Old 11-06-2017, 11:55 AM   #3
jac1
LQ Newbie
 
Registered: Nov 2017
Posts: 3

Original Poster
Rep: Reputation: Disabled
According to documentation, if you use iifname, the interface does not have to exist prior to creation of the rule, but iif does require that the interface exists.
I have tested iifname on another linux box running 4.9.49 and it works fine.
On 4.9.59 it doesn't, BUT I am assuming that something so basic was not removed from support, and that I am just missing some module to load.
I can't figure out what is missing though!

Last edited by jac1; 11-06-2017 at 11:58 AM.
 
Old 11-13-2017, 10:13 AM   #4
jac1
LQ Newbie
 
Registered: Nov 2017
Posts: 3

Original Poster
Rep: Reputation: Disabled
endianness

this turned out to be a problem with string endianness, on big endian platforms. I upgraded to nftables v0.7 and this problem went away.
However, now I am unable to have both dport and sport matching on one rule line.
For example, I used to be able to have the following rule in nftables v0.5 :
tcp sport ssh tcp dport ssh counter accept

Now this does NOT match.
I have to separate into two rules
tcp sport ssh counter accept
tcp dport ssh counter accept

Is this a bug or a *feature*?
 
Old 11-13-2017, 02:06 PM   #5
AwesomeMachine
LQ Guru
 
Registered: Jan 2005
Location: USA and Italy
Distribution: Debian testing/sid; OpenSuSE; Fedora; Mint
Posts: 5,524

Rep: Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015
I'd say it's a feature. Mixing sport and dport on the same line could lead to confusion, when you could just use ports.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
NFTables To Replace iptables In the Linux Kernel jeremy Linux - News 0 10-21-2013 11:02 AM
LXer: NFTables IPTables-Replacement Queued For Linux 3.13 LXer Syndicated Linux News 0 10-20-2013 08:41 AM
sed and regexp matching (GNU sed version 4.2.1) Ashkhan Programming 8 02-27-2012 09:12 AM
[SOLVED] awk with pipe delimited file (specific column matching and multiple pattern matching) lolmon Programming 4 08-31-2011 12:17 PM
LXer: Linux: First Release Of nftables LXer Syndicated Linux News 0 04-02-2010 06:00 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 01:13 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration