Linux NFTables Support in fwknop

[theckman]

NFTables, which is a new packet filter subsystem for the Linux kernel, has been pulled in to the git tree for the Linux 3.13 build. NFTables is on-track to replace the tried-and-true iptables system.

This issue is to request that, when NFTables is pushed in to mainline, support be added to fwknop.

I'm not sure what systems/kernels you have access to for development purposes, but if needed I should be able to provide a system with nftables / Linux 3.13

[mrash]

Thanks for the suggestion. This will definitely be added to fwknop and the other cipherdyne.org projects as well.

[mrash]

With the new command open/close cycle stuff, I think integrating with NFTables will be easy.

[fabianfrz]

are there any news on this issue?

[LuciferSam86]

any news?

[andrewgdunn]

I'll poke at this as well, it's blocking our deployment.

[mauricev]

Perhaps it's not as easy as originally expected. 😐

[mpsOxygen]

Wow, it's been 8 years and nothing?

[q2dg]

9 years already

[Stephen-Seo]

I think it may be possible to use a custom script that takes the iptables ... command and uses iptables-translate ... to convert the iptables ... command to an nft ... equivalent (see the "command translation" section on this page on nftables). Might have to convert the filter name if the current nftables ruleset uses a differently named filter name.

I think this is possible because this option --with-iptables=/path/to/iptables exists. Maybe just have it point to your custom script, and have the script convert the iptables ... command and apply it to the current nftables rules.

It's kind of a "hack" to get it working this way, as one would probably have to write up their own script and have some checks in place so that the rule would work correctly with the current nftables ruleset.

EDIT: Oh wait, the --with-iptables=... is a compiler (configure) option, not a command option..

EDIT2: So I 'm guessing fwknop uses the first valid iptables command in $PATH. Maybe one could create a script, name it as iptables, and place it in some other directory and prepend that directory into $PATH. One would have to make sure the server would use that custom $PATH though. Seems a bit too much trouble to get it working this way, unless you really want it to use nftables rules.

EDIT3: So it looks like one can set the FIREWALL_EXE in the fwknopd.conf, so doing some $PATH hackery is probably not needed. I may investigate what a custom script should be to be able to handle nftables.

EDIT4: It appears that fwknopd expects to work with output from iptables ..., so I don't think the "custom script approach" will work here. fwknop will have to implement proper nftables support, unless I overlooked something.

[geo99918]

10 years, is this going to be fixed or we look for alternatives to fwknop ?

[bam80]

Yeah that's become critical..
Speaking of the alternatives, what do we actually have?

[geo99918]

Yeah that's become critical.. Speaking of the alternatives, what do we actually have?

I heard wireguard has similar feature of not revealing itself unless the package with right key arrives.
Maybe not the same functionality but we can live with it.

[bam80]

Speaking of wireguard for openwrt low powered devices particularly, some time ago I had success with this project:
https://github.com/adyanth/openwrt-tailscale-enabler
It's a overkill of course but I see no other real alternatives right now..