Re: Netfilter not dropping packets as it should

At first, thank you very much for taking the time!

On 01.02.2025 11:30, Berto Furth wrote:
> Hi Binarus,
> 
> A non expert here....so my answer if probably rubbish...but anyway...
> 
> I went ahead and loaded your listed configuration into my /etc/nftables.conf file.
> 
> I got an error when I tried to load your configuration and as such IP traffic was allowed because there were essentially no nftables rules operating.

At least, I understand that part. If there is an error when loading, then no rules are active and everything is allowed (unless you had another ruleset in place before).

> The lines that generated an error were as follows..
> 
> # nft -c -f /etc/nftables.conf
> /etc/nftables.conf:27:26-40: Error: invalid priority expression value in this context.
>       type nat hook input priority dstnat; policy drop;
>                           ^^^^^^^^^^^^^^^
> /etc/nftables.conf:41:27-41: Error: invalid priority expression value in this context.
>       type nat hook output priority srcnat; policy drop;
>                            ^^^^^^^^^^^^^^^
> However when I replaced "dstnat" with "-100" and "srcnat" with "100" the nftables filers were accepted and IPv4 traffic to the unit stopped.

I believe (but may be wrong) that this might be due the different versions we use. I am not sure if previous (or later) versions understand the same symbolic names for priorities.

Unfortunately, in my initial post I forgot to mention what versions I am on: It is kernel 6.1.0 and nftables 1.0.6 (nice permutation by the way ...). This is a vanilla Debian bookworm box, updated to the latest patches at the time of writing.

I'll now add info about the versions as a direct reply to my first post, and I'll try tracing as instructed by the very first reply in this thread.

Best regards,

Binarus


> 
> The diffs between what I used and what you posted are as follows
> 
> *** /etc/nftables.conf.binarus  2025-02-01 21:25:46.418090954 +1100
> --- /etc/nftables.conf  2025-02-01 21:25:22.198057049 +1100
> ***************
> *** 24,30 ****
>       }
>    
>       chain input-nat {
> !      type nat hook input priority dstnat; policy drop;
>         log prefix "ip4-input-nat:" drop;
>       }
>       chain input-filter {
> --- 24,30 ----
>       }
>    
>       chain input-nat {
> !      type nat hook input priority -100; policy drop;
>         log prefix "ip4-input-nat:" drop;
>       }
>       chain input-filter {
> ***************
> *** 38,44 ****
>       }
>    
>       chain output-nat {
> !      type nat hook output priority srcnat; policy drop;
>         log prefix "ip4-output-nat:" drop;
>       }
>       chain output-filter {
> --- 38,44 ----
>       }
>    
>       chain output-nat {
> !      type nat hook output priority 100; policy drop;
>         log prefix "ip4-output-nat:" drop;
>       }
>       chain output-filter {
> 
> I hope that helps.
> 
> Berto.
> 
> 
> On Fri, 31 Jan 2025, at 06:35, Binarus wrote:
>> Dear experts,
>>
>> this is a cross posting, see
>> https://unix.stackexchange.com/questions/789174/netfilter-not-dropping-packets-as-it-should.
>> Since I didn't get an answer there for a couple of weeks, I am
>> repeating the question here in the hope that the problem can easily be
>> reproduced. For me this is a very important key point in understanding
>> netfilter / nftables.
>>
>> Please consider the ruleset that's at the end of this post. It doesn't
>> make any sense, but it lets everybody reproduce the problem easily.
>>
>> With this ruleset, all IPv4 packets that come in via enp0s3 are
>> accepted in the ingress hook, but finally traverse a chain with a drop
>> policy. Each of these chains does not contain any explicit rule besides
>> the drop policy, and thus should behave as it would (only) contain an
>> explicit drop verdict for all packets.
>>
>> Hence, applications on that machine should not see any IPv4 packets
>> that originate from other machines.
>>
>> But they definitely do. For example, I have an SSH daemon running on
>> that machine. The daemon listens on an IPv4 address only (in fact, I
>> have disabled IPv6 on that machine completely by adding ipv6.disable=1
>> to the kernel command line). Even after I have loaded the ruleset
>> below, I can connect to the SSH daemon via IPv4 from the outside
>> without any issue.
>>
>> Can somebody please explain why the rules below don't make the kernel
>> drop all incoming IPv4 packets? Did I misunderstand the purpose of the
>> drop policy?
>>
>> Thank you very much in advance, and best regards,
>>
>> Binarus
>>
>>
>>
>>
>>
>> table netdev t_NETDEV_enp0s3 {
>>     chain enp0s3-ingress-filter {
>>       type filter hook ingress device "enp0s3" priority filter; policy drop;
>>       ether type 0x0806 arp ptype 0x0800 accept
>>       ether type 0x0800 accept
>>       log prefix "foo: " drop
>>     }
>> }
>>
>> table ip t_IP {
>>
>>     chain prerouting-nat {
>>       type nat hook prerouting priority dstnat; policy drop;
>>       log prefix "ip4-prerouting-nat:" drop;
>>     }
>>     chain prerouting-filter {
>>       type filter hook prerouting priority filter; policy drop;
>>       log prefix "ip4-prerouting-filter:" drop;
>>     }
>>
>>     chain input-nat {
>>       type nat hook input priority dstnat; policy drop;
>>       log prefix "ip4-input-nat:" drop;
>>     }
>>     chain input-filter {
>>       type filter hook input priority filter; policy drop;
>>       log prefix "ip4-input-filter:" drop;
>>     }
>>
>>     chain forward-filter {
>>       type filter hook forward priority filter; policy drop;
>>       log prefix "ip4-forward-filter:" drop;
>>     }
>>
>>     chain output-nat {
>>       type nat hook output priority srcnat; policy drop;
>>       log prefix "ip4-output-nat:" drop;
>>     }
>>     chain output-filter {
>>       type filter hook output priority filter; policy drop;
>>       log prefix "ip4-output-filter:" drop;
>>     }
>>     chain output-route {
>>       type route hook output priority mangle; policy drop;
>>       log prefix "ip4-output-route:" drop;
>>     }
>>
>>     chain postrouting-nat {
>>       type nat hook postrouting priority srcnat; policy drop;
>>       log prefix "ip4-postrouting-nat:" drop;
>>     }
>>     chain postrouting-filter {
>>       type filter hook postrouting priority filter; policy drop;
>>       log prefix "ip4-postrouting-filter:" drop;
>>     }
>> }