<div dir="auto"><div><br><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sun, May 29, 2022, 01:03 Tim McConnell <<a href="mailto:tmcconnell168@gmail.com">tmcconnell168@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Package: nftables<br>
Version: 1.0.2-1<br>
Severity: important<br>
File: nftables.conf<br>
Tags: ipv6<br>
X-Debbugs-Cc: <a href="mailto:tmcconnell168@gmail.com" target="_blank" rel="noreferrer">tmcconnell168@gmail.com</a><br>
<br>
Dear Maintainer,<br>
<br>
What led up to the situation?<br>
Trying to configure and enable nftables to stop ip6 neighbor discovery packets<br>
from being rejected by VPN<br>
<br>
What exactly did you do (or not do) that was effective (or<br>
ineffective)? Attempted to use workstation.nft in examples folder and<br>
looked for documentation on the web.I couldn't find anything newer than 2014<br>
and asked on Debian Forums and Linuxquestions.org<br>
<br>
What was the outcome of this action?<br>
Attempt to run 'sudo systemctl start nftables.service' and receive this error:<br>
Job for nftables.service failed because the control process exited with error<br>
code.<br>
See "systemctl status nftables.service" and "journalctl -xeu nftables.service"<br>
for details.<br>
tmick@DebianTim:~/recap$ sudo systemctl status nftables.service<br>
× nftables.service - nftables<br>
Loaded: loaded (/lib/systemd/system/nftables.service; enabled; vendor<br>
preset: enabled)<br>
Active: failed (Result: exit-code) since Sat 2022-05-28 16:39:05 CDT; 7s<br>
ago<br>
Docs: man:nft(8)<br>
<a href="http://wiki.nftables.org" rel="noreferrer noreferrer" target="_blank">http://wiki.nftables.org</a><br>
Process: 1704177 ExecStart=/usr/sbin/nft -f /etc/nftables.conf<br>
(code=exited, status=1/FAILURE)<br>
Main PID: 1704177 (code=exited, status=1/FAILURE)<br>
CPU: 24ms<br>
<br>
May 28 16:39:05 DebianTim nft[1704177]:<br>
^^^^^^<br>
May 28 16:39:05 DebianTim nft[1704177]: /etc/nftables.conf:18:3-6: Error:<br>
syntax error, unexpected meta<br>
May 28 16:39:05 DebianTim nft[1704177]: meta nexthdr ipv6<br>
icmpv6 type { destination-unreachable, packet-too><br>
May 28 16:39:05 DebianTim nft[1704177]: ^^^^<br>
May 28 16:39:05 DebianTim nft[1704177]: /etc/nftables.conf:19:8-12: Error:<br>
syntax error, unexpected saddr, expecting string<br>
May 28 16:39:05 DebianTim nft[1704177]: ipv6 saddr fe80::/10<br>
icmpv6 type { 130, 131, 132, 134, 143, 151, 15><br>
May 28 16:39:05 DebianTim nft[1704177]: ^^^^^<br>
May 28 16:39:05 DebianTim systemd[1]: nftables.service: Main process exited,<br>
code=exited, status=1/FAILURE<br>
May 28 16:39:05 DebianTim systemd[1]: nftables.service: Failed with result<br>
'exit-code'.<br>
May 28 16:39:05 DebianTim systemd[1]: Failed to start nftables.<br>
I've tried other methods as inet etc and still get this type of error.<br>
<br>
What outcome did you expect instead? For documentation to be clear enough for<br>
this not to be a problem and the nftables to be able to add this filter.<br>
<br>
<br>
-- System Information:<br>
Debian Release: bookworm/sid<br>
APT prefers testing<br>
APT policy: (500, 'testing')<br>
Architecture: amd64 (x86_64)<br>
Foreign Architectures: i386<br>
<br>
Kernel: Linux 5.17.0-1-rt-amd64 (SMP w/2 CPU threads; PREEMPT)<br>
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set<br>
Shell: /bin/sh linked to /usr/bin/dash<br>
Init: systemd (via /run/systemd/system)<br>
LSM: AppArmor: enabled<br>
<br>
Versions of packages nftables depends on:<br>
ii libc6 2.33-7<br>
ii libedit2 3.1-20210910-1<br>
ii libnftables1 1.0.2-1<br>
<br>
Versions of packages nftables recommends:<br>
ii netbase 6.3<br>
<br>
Versions of packages nftables suggests:<br>
pn firewalld <none><br>
<br>
-- Configuration Files:<br>
/etc/nftables.conf changed:<br>
flush ruleset<br>
table enp1s0 filter {<br></blockquote></div></div><div dir="auto"><br></div><div dir="auto">This table declaration is missing family specificiation, which defaults to IPv4. I think you canot use IPv6 stuff in v4 tables.</div><div dir="auto"><br></div><div dir="auto">I think you may want to use a table in the 'inet' family, which is dual-stack, and should accept both IPv4 and IPv6 stuff.</div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
chain base_checks {<br>
# Drop invalid connections and allow established/related connections<br>
ct state invalid drop<br>
ct state {established, related} accept<br>
}<br>
<br>
chain input {<br>
type filter hook input priority 0; policy drop;<br>
meta nexthdr ipv6 icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, echo-reply, echo-request, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, 148, 149 } accept<br>
ipv6 saddr fe80::/10 icmpv6 type { 130, 131, 132, 134, 143, 151, 152, 153 } accept<br>
jump base_checks<br>
# Allow from loopback<br>
iifname lo accept<br>
iifname != lo ip daddr <a href="http://127.0.0.0/32" rel="noreferrer noreferrer" target="_blank">127.0.0.0/32</a> drop<br>
# New UDP traffic will jump to the UDP chain<br>
ip protocol udp ct state new jump UDP<br>
# New TCP traffic will jump to the TCP chain<br>
tcp flags & (fin | syn | rst | ack) == syn ct state new jump TCP<br>
# Everything else<br>
ip protocol udp reject<br>
ip protocol tcp reject with tcp reset<br>
reject with icmpx type port-unreachable<br>
}<br>
chain forward {<br>
type filter hook forward priority 0; policy drop;<br>
} <br>
chain output {<br>
type filter hook output priority 0; policy accept;<br>
}<br>
<br>
# count and drop any other traffic<br>
counter enp1s0{}<br>
##CHAIN RULES<br>
# TCP chain<br>
set TCP_accepted {<br>
type inet_service; flags interval; <br>
elements = {1714-1764}<br>
}<br>
chain TCP {<br>
tcp dport @TCP_accepted accept<br>
} <br>
# UDP chain<br>
set UDP_accepted {<br>
type inet_service; flags interval;<br>
elements = {1714-1764}<br>
}<br>
chain UDP {<br>
udp dport @UDP_accepted accept<br>
}<br>
}<br>
<br>
<br>
-- no debconf information<br>
</blockquote></div></div></div>