Using nftables for routing and access control

last update 2025/06/30

Overview diagram

config

Back up the default config file

cp -p /etc/sysconfig/nftables.conf /etc/sysconfig/nftables.conf.org

Configuration item

config	notes
flush ruleset	Remove the existing nftables ruleset as a precaution.
include	Specify the whitelist file.
table ip filter	Include a condition in this part.
set country_accept	Create a named set of IP addresses.
chain INPUT	Inbound traffic is dropped by default.
iifname "lo" counter accept	ループバックはすべて許可
ct state	各通信ごとに許可設定
icmp type	Echo Reply（ping応答）, Destination Unreachable, Time Exceeded のみ許可
chain FORWARD	マスカレードに必要なため、forward通信はすべて許可
chain OUTPUT	outbound通信はすべて許可
chain prerouting
chain postrouting	マスカレードする通信元のNICを指定

Configuration

注釈

■ OpenVPN用の設定

・Filter

・inbound

・lo を許可

・country_whitelistに記載のIPアドレスからのTCPポート22を許可

・country_whitelistに記載のIPアドレスからのUDPポート1194を許可

・icmpを許可

・forward

・マスカレード用にすべて許可

・outbound

・すべて許可

・NAT

・eth0からのマスカレードを設定

/etc/sysconfig/nftables.conf

flush ruleset

include "/etc/nftables/country_whitelist"

table ip filter {
  set country_accept {
    type ipv4_addr; flags interval;
    elements = $country_whitelist
  }

  chain INPUT {
    type filter hook input priority 0; policy drop;
    iifname "lo" counter accept

    ct state established,related counter accept
    ct state new tcp dport 22 ip saddr @country_accept counter accept
    ct state new udp dport 1194 ip saddr @country_accept counter accept

    icmp type echo-reply counter accept
    icmp type destination-unreachable counter accept
    icmp type time-exceeded counter accept
  }
  chain FORWARD {
    type filter hook forward priority 0; policy accept;
  }
  chain OUTPUT {
    type filter hook output priority 0; policy accept;
  }
}
table ip nat {
  chain prerouting {
    type nat hook prerouting priority 0;
  }
  chain postrouting {
    type nat hook postrouting priority 0;
    oifname "eth0" masquerade
  }
}

Start nftables

start nftables

systemctl enable nftables
systemctl start nftables

Verify the ruleset

nft list ruleset