Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1694723 - [RFE] Add nftables default config
Summary: [RFE] Add nftables default config
Keywords:
Status: NEW
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: nftables
Version: 7.5
Hardware: Unspecified
OS: Linux
unspecified
medium
Target Milestone: rc
: ---
Assignee: Phil Sutter
QA Contact: qe-baseos-daemons
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-04-01 13:18 UTC by Davide F Bragalone
Modified: 2019-04-01 22:34 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Target Upstream Version:


Attachments (Terms of Use)

Description Davide F Bragalone 2019-04-01 13:18:56 UTC
Description:

When iptables or firewalld are used, there is a default configuration that allows some common services and deny all the rest. This is not valid for nftables though, as upon activation, all the traffic is allowed.

I quickly tested by deploying a RHEL7.5, disabling firewalld and installing nftables. Then I put ncat in listening on 12345 port and I was able to establish a connection from a remote host. With firewalld/iptables I would have to open the new port which is also good for security purposes (white-list approach).


Customer stated:
================================================================
What I missed most was the default nftables rules file that you can just take in the use like in iptables. In RHEL and Fedora there was this file:

cat /etc/sysconfig/iptables
# sample configuration for iptables service
# you can edit this manually or use system-config-firewall
# please do not ask us to add additional ports/services to this default configuration
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

You just started adding allow rules to it. It was very simple. And that is why I sent you my default nftables template so that there could be some kind of default nftables configuration in RHEL/Fedora that would be secure and works out-of-box. You just need to enable the configuration (for example uncomment a line in /etc/sysconfig/nftables.conf and enable nftables via systemctl) and you are ready to go with secure firewall.
================================================================

Version-Release number of selected component (if applicable):
# rpm -qa | grep nft
libnftnl-1.0.8-1.el7.x86_64
nftables-0.8-10.el7.x86_64



Customer also proposed similar config (nftables.default file):
#! /usr/sbin/nft -f

table ip filter {
  chain input {
    type filter hook input priority 0;

    ct state established,related counter accept
    ip protocol icmp counter accept
    iif lo accept
    ct state invalid counter drop

    ct state new tcp dport 22 counter accept

    # multicast DNS (mdns)
    ct state new ip daddr 224.0.0.251 udp dport 5353 counter accept

    limit rate 3 / minute log flags ip options flags tcp options prefix "FW "
    counter reject with icmp type host-prohibited
  }

  chain forward {
    type filter hook forward priority 0;
    counter reject with icmp type host-prohibited
  }
}

table ip6 filter {
  chain input {
    type filter hook input priority 0;

    ct state established,related counter accept
    meta l4proto ipv6-icmp counter accept
    iif lo accept
    ct state invalid counter drop

    # dhcpv6-client
    ct state new ip6 daddr fe80::/64 udp dport 546 counter accept
    # multicast DNS (mdns)
    ct state new ip6 daddr ff02::fb udp dport 5353 counter accept

    limit rate 3 / minute log flags ip options flags tcp options prefix "FW "
    counter reject with icmpv6 type admin-prohibited
  }

  chain forward {
    type filter hook forward priority 0;
    counter reject with icmpv6 type admin-prohibited
  }
}


Note You need to log in before you can comment on or make changes to this bug.