nftables

package
v0.78.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 4, 2026 License: BSD-3-Clause Imports: 31 Imported by: 1

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type InterfaceAllower added in v0.78.0 

type InterfaceAllower struct {
	// contains filtered or unexported fields
}

InterfaceAllower opens the NetBird interface in the kernel's filter table and external chains and keeps them reconciled via a netlink monitor, so the host firewall doesn't drop traffic the NetBird firewall handles. It is used by the userspace firewall, where routing happens in the forwarder, so only INPUT is opened (the userspace router never forwards in the kernel).

It owns its own families/connection and never creates a netbird work table. firewalld trust is handled by the caller, not here. Its operations are serial (Apply before the monitor starts; reconciles run on the single monitor goroutine; Close stops the monitor before removing), so it needs no locking.

TODO: this opens nftables and the iptables-nft filter table (detected via nft), but not a legacy-iptables ruleset running in parallel with nftables. Such a host would keep its legacy filter chains closed for the interface.

func NewInterfaceAllower added in v0.78.0 

func NewInterfaceAllower(wgIface iFaceMapper, mtu uint16) (*InterfaceAllower, error)

NewInterfaceAllower builds an allower for the given interface. It returns an error when nftables is unavailable (e.g. an iptables-legacy host), so the caller can fall back to firewalld trust.

func (*InterfaceAllower) Apply added in v0.78.0 

func (a *InterfaceAllower) Apply() error

Apply opens the interface (INPUT only) in the foreign filter chains and starts reconciling them on nftables changes.

func (*InterfaceAllower) Close added in v0.78.0 

func (a *InterfaceAllower) Close() error

Close stops the monitor and removes the accept rules.

type InterfaceState added in v0.30.3 

type InterfaceState struct {
	NameStr   string         `json:"name"`
	WGAddress wgaddr.Address `json:"wg_address"`
	MTU       uint16         `json:"mtu"`
}

func (*InterfaceState) Address added in v0.30.3 

func (i *InterfaceState) Address() wgaddr.Address

func (*InterfaceState) Name added in v0.30.3 

func (i *InterfaceState) Name() string

type Manager 

type Manager struct {
	// contains filtered or unexported fields
}

Manager of nftables firewall. Per-family state (peer ACLs, route ACLs, NAT, DNAT, MSS clamping) lives on family; Manager dispatches by family and provides the public firewall.Manager surface.

func Create 

func Create(wgIface iFaceMapper, mtu uint16) (*Manager, error)

Create nftables firewall manager

func (*Manager) AddDNATRule added in v0.38.0 

func (m *Manager) AddDNATRule(rule firewall.ForwardRule) (firewall.Rule, error)

AddDNATRule adds a DNAT rule

func (*Manager) AddFilterRule added in v0.78.0 

func (m *Manager) AddFilterRule(
	id []byte,
	sources []netip.Prefix,
	destination firewall.Network,
	proto firewall.Protocol,
	sPort *firewall.Port,
	dPort *firewall.Port,
	action firewall.Action,
) (firewall.Rule, error)

AddFilterRule installs a packet-filtering rule.

Destination semantics: zero Network → input chain (peer ACL); set Network → forward chain (route ACL).

Sources are a single address family; the rule is dispatched to the matching per-family backend.

func (*Manager) AddInboundDNAT added in v0.59.9 

func (m *Manager) AddInboundDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error

AddInboundDNAT adds an inbound DNAT rule redirecting traffic from NetBird peers to local services.

func (*Manager) AddNatRule added in v0.30.0 

func (m *Manager) AddNatRule(pair firewall.RouterPair) error

func (*Manager) AddOutputDNAT added in v0.68.0 

func (m *Manager) AddOutputDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error

AddOutputDNAT adds an OUTPUT chain DNAT rule for locally-generated traffic.

func (*Manager) Close added in v0.37.2 

func (m *Manager) Close(stateManager *statemanager.Manager) error

Close closes the firewall manager

func (*Manager) DeleteDNATRule added in v0.38.0 

func (m *Manager) DeleteDNATRule(rule firewall.Rule) error

DeleteDNATRule deletes a DNAT rule

func (*Manager) DeleteFilterRule added in v0.78.0 

func (m *Manager) DeleteFilterRule(rule firewall.Rule) error

DeleteFilterRule removes a filtering rule. The owning family is found by id in the in-memory filter maps, which are the only tracking for filter rules. family.DeleteFilterRule is idempotent when the id is absent.

func (*Manager) DisableRouting added in v0.36.6 

func (m *Manager) DisableRouting() error

func (*Manager) EnableRouting added in v0.36.6 

func (m *Manager) EnableRouting() error

func (*Manager) Flush added in v0.21.9 

func (m *Manager) Flush() error

Flush rule/chain/set operations from the buffer

Method also get all rules after flush and refreshes handle values in the rulesets todo review this method usage

func (*Manager) Init added in v0.30.3 

func (m *Manager) Init(stateManager *statemanager.Manager) error

Init nftables firewall manager

func (*Manager) IsServerRouteSupported added in v0.24.4 

func (m *Manager) IsServerRouteSupported() bool

func (*Manager) IsStateful added in v0.46.0 

func (m *Manager) IsStateful() bool

func (*Manager) RemoveInboundDNAT added in v0.59.9 

func (m *Manager) RemoveInboundDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error

RemoveInboundDNAT removes an inbound DNAT rule.

func (*Manager) RemoveNatRule added in v0.30.0 

func (m *Manager) RemoveNatRule(pair firewall.RouterPair) error

func (*Manager) RemoveOutputDNAT added in v0.68.0 

func (m *Manager) RemoveOutputDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error

RemoveOutputDNAT removes an OUTPUT chain DNAT rule.

func (*Manager) SetLegacyManagement added in v0.30.0 

func (m *Manager) SetLegacyManagement(isLegacy bool) error

SetLegacyManagement sets the route manager to use legacy management

func (*Manager) SetLogLevel added in v0.36.6 

func (m *Manager) SetLogLevel(log.Level)

SetLogLevel sets the log level for the firewall manager

func (*Manager) SetupEBPFProxyNoTrack added in v0.64.2 

func (m *Manager) SetupEBPFProxyNoTrack(proxyPort, wgPort uint16) error

SetupEBPFProxyNoTrack creates notrack rules for eBPF proxy loopback traffic. This prevents conntrack from tracking WireGuard proxy traffic on loopback, which can interfere with MASQUERADE rules (e.g., from container runtimes like Podman/netavark).

Traffic flows that need NOTRACK:

  1. Egress: WireGuard -> fake endpoint (before eBPF rewrite) src=127.0.0.1:wgPort -> dst=127.0.0.1:fakePort Matched by: sport=wgPort

  2. Egress: Proxy -> WireGuard (via raw socket) src=127.0.0.1:fakePort -> dst=127.0.0.1:wgPort Matched by: dport=wgPort

  3. Ingress: Packets to WireGuard dst=127.0.0.1:wgPort Matched by: dport=wgPort

  4. Ingress: Packets to proxy (after eBPF rewrite) dst=127.0.0.1:proxyPort Matched by: dport=proxyPort

Rules are cleaned up when the firewall manager is closed.

func (*Manager) UpdateSet added in v0.43.0 

func (m *Manager) UpdateSet(set firewall.Set, prefixes []netip.Prefix) error

UpdateSet updates the set with the given prefixes

type Rule 

type Rule struct {
	// contains filtered or unexported fields
}

Rule wraps an installed filter rule (peer or route). Source set membership is encoded in the rule's expressions; DeleteFilterRule recovers the set name via findSets so the refcounter can drop the right reference. mangleRule is set only for peer rules.

func (*Rule) ID added in v0.38.0 

func (r *Rule) ID() manager.RuleID

ID returns the rule id

type ShutdownState added in v0.30.3 

type ShutdownState struct {
	InterfaceState *InterfaceState `json:"interface_state,omitempty"`
}

func (*ShutdownState) Cleanup added in v0.30.3 

func (s *ShutdownState) Cleanup() error

func (*ShutdownState) Name added in v0.30.3 

func (s *ShutdownState) Name() string

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.