pespin has uploaded this change for review.
doc: Update all iptables references with nftables
Change-Id: I3caf316e8ccf1d757b83f7a119271084c55e018c
---
M doc/examples/firewall
M doc/manuals/chapters/mtu.adoc
M doc/manuals/chapters/running.adoc
3 files changed, 23 insertions(+), 23 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-ggsn refs/changes/25/38525/1
diff --git a/doc/examples/firewall b/doc/examples/firewall
index fce735a..d5fadec 100755
--- a/doc/examples/firewall
+++ b/doc/examples/firewall
@@ -13,36 +13,36 @@
# to and from the Gn interface.
# * Masquerede on Gi interface.
-IPTABLES="/sbin/iptables"
+NFT="nft"
IFGN="eth0"
IFGI="eth1"
-$IPTABLES -P INPUT DROP
-$IPTABLES -P FORWARD ACCEPT
-$IPTABLES -P OUTPUT ACCEPT
+$NFT add chain ip filter input '{ policy drop; }'
+$NFT add chain ip filter forward '{ policy accept; }'
+$NFT add chain ip filter output '{ policy accept; }'
#Allow related and established on all interfaces (input)
-$IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+$NFT add rule ip filter input ct state related,established counter accept
#Allow releated, established, GTP and ssh on $IFGN. Reject everything else.
-$IPTABLES -A INPUT -i $IFGN -p tcp -m tcp --dport 22 --syn -j ACCEPT
-$IPTABLES -A INPUT -i $IFGN -p udp -m udp --dport 2123 -j ACCEPT
-$IPTABLES -A INPUT -i $IFGN -p udp -m udp --dport 2152 -j ACCEPT
-$IPTABLES -A INPUT -i $IFGN -p udp -m udp --dport 3386 -j ACCEPT
-$IPTABLES -A INPUT -i $IFGN -j REJECT
+$NFT add rule ip filter input iifname $IFGN tcp dport 22 tcp flags syn / fin,syn,rst,ack counter accept
+$NFT add rule ip filter input iifname $IFGN udp dport 2123 counter accept
+$NFT add rule ip filter input iifname $IFGN udp dport 2152 counter accept
+$NFT add rule ip filter input iifname $IFGN udp dport 3386 counter accept
+$NFT add rule ip filter input iifname $IFGN counter reject
#Allow related, established and ssh. Drop everything else.
-$IPTABLES -A INPUT -i $IFGI -p tcp -m tcp --dport 22 --syn -j ACCEPT
-$IPTABLES -A INPUT -i $IFGI -j DROP
+$NFT add rule ip filter input iifname $IFGI tcp dport 22 tcp flags syn / fin,syn,rst,ack counter accept
+$NFT add rule ip filter input iifname $IFGI counter drop
# Masquerade everything going out on $IFGI
-$IPTABLES -t nat -A POSTROUTING -o $IFGI -j MASQUERADE
+$NFT add rule ip nat POSTROUTING oifname $IFGI counter masquerade
#Allow everything on loopback interface.
-$IPTABLES -A INPUT -i lo -j ACCEPT
+$NFT add rule ip filter input iifname "lo" counter accept
# Drop everything to and from $IFGN (forward)
-$IPTABLES -A FORWARD -i $IFGN -j DROP
-$IPTABLES -A FORWARD -o $IFGN -j DROP
+$NFT add rule ip filter forward iifname $IFGN counter drop
+$NFT add rule ip filter forward oifname $IFGN counter drop
diff --git a/doc/manuals/chapters/mtu.adoc b/doc/manuals/chapters/mtu.adoc
index eb323d6..041219f 100644
--- a/doc/manuals/chapters/mtu.adoc
+++ b/doc/manuals/chapters/mtu.adoc
@@ -146,13 +146,13 @@
MSS = TUNNEL_MTU - IP_HDR - TCP_HDR = 1420 - 60 - 56 = 1304
----
-In linux, the MSS of TCP connections can be clamped using iptables:
+In linux, the MSS of TCP connections can be clamped using nftables:
----
-iptables -t nat -A PREROUTING -p tcp --tcp-flags SYN,RST SYN -i apn0 -j TCPMSS --set-mss 1304
-iptables -t nat -I POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o apn0 -j TCPMSS --set-mss 1304
-ip6tables -t nat -A PREROUTING -p tcp --tcp-flags SYN,RST SYN -i apn0 -j TCPMSS --set-mss 1304
-ip6tables -t nat -I POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o apn0 -j TCPMSS --set-mss 1304
+nft 'add rule ip nat prerouting iifname "apn0" tcp flags syn / syn,rst counter tcp option maxseg size set 1304'
+nft 'insert rule ip nat postrouting oifname "apn0" tcp flags syn / syn,rst counter tcp option maxseg size set 1304'
+nft 'add rule ip6 nat prerouting iifname "apn0" tcp flags syn / syn,rst counter tcp option maxseg size set 1304'
+nft 'insert rule ip6 nat postrouting oifname "apn0" tcp flags syn / syn,rst counter tcp option maxseg size set 1304'
----
==== Further Reading
diff --git a/doc/manuals/chapters/running.adoc b/doc/manuals/chapters/running.adoc
index 386b6b5..99fa11d 100644
--- a/doc/manuals/chapters/running.adoc
+++ b/doc/manuals/chapters/running.adoc
@@ -43,14 +43,14 @@
----
sh -c "echo 1 > /proc/sys/net/ipv4/ip_forward"
-iptables -t nat -A POSTROUTING -o '*' -j MASQUERADE
+nft 'add rule ip nat postrouting oifname "\*" counter masquerade'
----
(You may want to replace `*` with the network device name, like `-o eth0`)
There are various ways to enable these settings persistently, please refer to
your distribution's documentation -- e.g. look for @net.ipv4.ip_forward=1@ in
-@/etc/sysctl.d/@, and https://wiki.debian.org/iptables for masquerading.
+@/etc/sysctl.d/@, and https://wiki.debian.org/nftables for masquerading.
include::{srcdir}/chapters/mtu.adoc[]
To view, visit change 38525. To unsubscribe, or for help writing mail filters, visit settings.