From 3e69865a56126f57a5a4a7de656cd49294b4363a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gardais=20J=C3=A9r=C3=A9my?= Date: Tue, 6 Feb 2018 15:50:31 +0100 Subject: [PATCH] Rename firewall table to filter table (most use on Debian). --- CHANGELOG.md | 3 +++ README.md | 6 +++--- templates/etc/nftables.conf.j2 | 2 +- 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ad27964..f26fd0e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,4 +1,7 @@ +## v1.2.3 +* Rename firewall table to filter table (most use on Debian). + ## v1.2.2 ### Fix diff --git a/README.md b/README.md index 6193d71..51670f5 100644 --- a/README.md +++ b/README.md @@ -158,7 +158,7 @@ flush ruleset include "/etc/nftables.d/defines.nft" -table inet firewall { +table inet filter { chain global { # 000 state management ct state established,related accept @@ -173,7 +173,7 @@ table inet firewall { And you can get all rules and definitons by displaying the ruleset on the host : `$ nft list ruleset` : ``` -table inet firewall { +table inet filter { set blackhole { type ipv4_addr elements = { 255.255.255.255, 224.0.0.1, 224.0.0.251} @@ -243,7 +243,7 @@ nft_input_group_rules: * The first run of a playbook may be long (~8 minutes) just after the (re)start of `nftables` service. * Probably due to Ansible/OpenSSH Specific default Settings, the outgoing connections for Ansible/SSH will be blocked : ``` -trace id d7c3a8dc inet firewall output packet: oif "ens18" ip saddr REMOTE_HOST ip daddr MY_HOST ip dscp 0x02 ip ecn not-ect ip ttl 64 ip id 56799 ip length 420 tcp sport ssh tcp dport 53922 tcp flags == 0x18 tcp window 1452 +trace id d7c3a8dc inet filter output packet: oif "ens18" ip saddr REMOTE_HOST ip daddr MY_HOST ip dscp 0x02 ip ecn not-ect ip ttl 64 ip id 56799 ip length 420 tcp sport ssh tcp dport 53922 tcp flags == 0x18 tcp window 1452 ``` * This only happen at the first run on new clean host. The next runs will works without any delay. diff --git a/templates/etc/nftables.conf.j2 b/templates/etc/nftables.conf.j2 index 625579d..42fc119 100755 --- a/templates/etc/nftables.conf.j2 +++ b/templates/etc/nftables.conf.j2 @@ -9,7 +9,7 @@ flush ruleset include "/etc/nftables.d/defines.nft" -table inet firewall { +table inet filter { chain global { {% for group, rules in globalmerged|dictsort %} # {{ group }}