Home / server / Questions / 772195
In Process
rfmoz
Asked: 2016-04-23 02:43:12 +0800 CST

Drop fragmented packets in nftables

  • 772

Using iptables is it possible to block fragmented packets with this rule:

iptables -A INPUT -f -j DROP

But there isn't a equivalent in nftables. There is any way to do it?

networking iptables ipv4 nftables packets

2 Answers

  1. From Nftables Wiki or just man nft you can use ip frag-off. Now (after a few trials and errors) the 3 flags (reserved, DF, MF) are included in this value at the 3 highest bits and have to be excluded from the test, needing a & operation. So this:

    nft 'add rule ip filter input ip frag-off & 0x1fff != 0 drop'

    Would do it...

    ... but when nf_conntrack_ipv4 is loaded (almost always), its specific nf_defrag_ipv4 part registers at hook priority -400, and will reassemble all fragments. That means any processing after won't see any fragment. So your chain has to hook with a priority value lower than that. Here's a complete working example:

    nft add table filter
nft 'add chain filter predefrag { type filter hook prerouting priority -450; }'
nft 'add rule ip filter predefrag ip frag-off & 0x1fff != 0 drop'

    Arguably the 1st packet is also a fragment with offset 0 but with MF set. So maybe 0x1fff should be replaced with 0x3fff to catch it.

    • 4

  2. try:

    iptables-translate -A INPUT -f -j DROP

    result:

    nft add rule ip filter INPUT ip frag-off != 0 counter drop

    iptables-translate comme from (on debian Debian 4.9.82-1+deb9u3 (2018-03-02) x86_64 GNU/Linux:

    apt install iptables-nftables-compat

    https://wiki.nftables.org/wiki-nftables/index.php/Configuring_chains#Base_chain_priority

    or nft 'add rule inet filter input ip frag-off 0x4000 counter accept'

    • 0