Comment on nftables: Can't ping my own server

pHr34kY@lemmy.world ⁨10⁩ ⁨hours⁩ ago

ip protocol icmp accept
meta l4proto ipv6-icmp accept

• confusedpuppy@lemmy.dbzer0.com ⁨9⁩ ⁨hours⁩ ago

  I tried your suggested rules and still nothing

  I went a step further and simply enabled all incoming connections with:

  table inet filter {
  	chain input {
  		type filter hook input priority 0; policy allow;
  	}
  }
  

  Again I can connect with SSH and WireGuard but I still can’t ping my server. If I restore to my last backup with iptables, I can get a response from ping again.

  I also tried directly translating the rules from iptables with:

  iptables-save > /tmp/iptables.dump
  iptables-restore-translate -f /tmp/iptables.dump > nftables.dump
  

  and adding the rules:

  #!/usr/sbin/nft -f
  
  define WIREGUARD_PORT = 51820
  define WIREGUARD_ADDRESS = 10.0.0.0/24
  define SSH_PORT = 5025
  define SSH_ADDRESSES = { $WIREGUARD_ADDRESS . $SSH_PORT, 192.168.40.204 . $SSH_PORT }
  define PUBLIC_PORTS = { 5050 }
  
  table inet filter {
          chain input {
                  udp dport $WIREGUARD_PORT accept \
                  comment "Accept WireGuard connections"
  
                  ip saddr . tcp dport $SSH_ADDRESSES accept \
                  comment "Accept SSH connections from known devices or WireGuard"
  
                  tcp dport $PUBLIC_PORTS accept \
                  comment "Accept public connections"
  
                  icmp type echo-request limit rate 5/second burst 10 packets counter accept
                  icmp type echo-request limit rate 30/minute burst 120 packets counter accept
                  icmp type echo-request limit rate 1/minute burst 2 packets counter log prefix " PING-PONG-FLOOD "
                  icmp type echo-request counter drop
  
                  icmp type destination-unreachable counter accept
                  icmp type time-exceeded counter accept
                  icmp type parameter-problem counter accept
                  icmp type echo-request counter accept
          }
          chain forward {
                  icmp type destination-unreachable counter accept
                  icmp type time-exceeded counter accept
                  icmp type parameter-problem counter accept
                  icmp type echo-request counter accept
          }
  }
  

  and still no ping from my server…

  I will agree, the documentation for nftables is just not as accessible or consistent as iptables. It’s a bit frustrating.

  original

  • pHr34kY@lemmy.world ⁨9⁩ ⁨hours⁩ ago

    Run nft list ruleset and make sure that the final result matches your config. Maybe it’s misinterpreting or discarding something?

    original

    • confusedpuppy@lemmy.dbzer0.com ⁨8⁩ ⁨hours⁩ ago

      I’ve been checking my rules with nft -c -f /etc/nftables.d/firewall.nft as well as checking the ruleset after every change and every change appears as it should. I’m stumped. Even more stumped because just allowing all traffic still doesn’t allow me to ping my server but I can access ssh, wireguard and my reverse proxy just fine. I would have assumed allowing all inbound traffic would also accept ping requests too…

      original