Après avoir installé nftables, le service ne démarre pas et le simple flush d'une ruleset sort en erreur.
J'ai beau chercher, je sèche, si vous avez une petite idée...
Code : Tout sélectionner
root@soekris:/var/log# cat /etc/nftables.conf
#!/usr/sbin/nft -f
flush ruleset
table inet filter {
chain input {
type filter hook input priority 0;
# accept any localhost traffic
iif lo accept
# accept traffic originated from us
ct state established,related accept
# activate the following line to accept common local services
#tcp dport { 22, 80, 443 } ct state new accept
# count and drop any other traffic
counter drop
}
}
Code : Tout sélectionner
root@soekris:/var/log# systemctl status nftables.service
● nftables.service - nftables
Loaded: loaded (/lib/systemd/system/nftables.service; enabled; vendor preset: enabled)
Active: failed (Result: exit-code) since Wed 2021-03-17 08:02:57 CET; 8s ago
Docs: man:nft(8)
http://wiki.nftables.org
Process: 7684 ExecStart=/usr/sbin/nft -f /etc/nftables.conf (code=exited, status=1/FAILURE)
Main PID: 7684 (code=exited, status=1/FAILURE)
Mar 17 08:02:57 soekris.home.moua7.com systemd[1]: Starting nftables...
Mar 17 08:02:57 soekris.home.moua7.com nft[7684]: /etc/nftables.conf:3:1-14: Error: Could not process rule: Address family not supported by protocol
Mar 17 08:02:57 soekris.home.moua7.com nft[7684]: flush ruleset
Mar 17 08:02:57 soekris.home.moua7.com nft[7684]: ^^^^^^^^^^^^^^
Mar 17 08:02:57 soekris.home.moua7.com systemd[1]: nftables.service: Main process exited, code=exited, status=1/FAILURE
Mar 17 08:02:57 soekris.home.moua7.com systemd[1]: nftables.service: Failed with result 'exit-code'.
Mar 17 08:02:57 soekris.home.moua7.com systemd[1]: Failed to start nftables.
Code : Tout sélectionner
root@soekris:/var/log# nft flush ruleset
Error: Could not process rule: Address family not supported by protocol
flush ruleset
^^^^^^^^^^^^^^
Code : Tout sélectionner
root@soekris:/var/log# lsmod | grep ^nf
nft_counter 12475 0
nf_conntrack_ipv6 17453 0
nf_defrag_ipv6 20950 1 nf_conntrack_ipv6
nf_conntrack_ipv4 18040 0
nf_defrag_ipv4 12443 1 nf_conntrack_ipv4
nft_ct 12674 0
nf_conntrack 73428 3 nft_ct,nf_conntrack_ipv4,nf_conntrack_ipv6
nft_meta 12613 0
nft_hash 16824 0
nft_rbtree 12679 0
nf_tables_inet 12491 0
nf_tables_ipv6 12518 1 nf_tables_inet
nf_tables_bridge 12494 0
nf_tables_ipv4 12557 2 nf_tables_inet
nf_tables 45218 9 nf_tables_inet,nf_tables_ipv4,nf_tables_ipv6,nft_ct,nf_tables_bridge,nft_hash,nft_meta,nft_rbtree,nft_counter
nfnetlink 12853 1 nf_tables
Code : Tout sélectionner
root@soekris:/var/log# ifconfig -a
br0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.1.42 netmask 255.255.255.0 broadcast 192.168.1.255
ether 00:00:24:c8:b3:9c txqueuelen 0 (Ethernet)
RX packets 2876152 bytes 367498958 (350.4 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 861934 bytes 156425001 (149.1 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
ether 00:00:24:c8:b3:9c txqueuelen 1000 (Ethernet)
RX packets 102489882 bytes 142063090989 (132.3 GiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 43316588 bytes 9266728364 (8.6 GiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
eth1: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
ether 00:00:24:c8:b3:9d txqueuelen 1000 (Ethernet)
RX packets 42813860 bytes 9173443875 (8.5 GiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 101787337 bytes 141932905494 (132.1 GiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
Code : Tout sélectionner
root@soekris:/var/log# cat /etc/network/interfaces
source /etc/network/interfaces.d/*
# The loopback network interface
auto lo
iface lo inet loopback
iface eth0 inet manual
iface eth1 inet manual
auto br0
iface br0 inet static
bridge_ports eth0 eth1
address 192.168.1.42
netmask 255.255.255.0
gateway 192.168.1.1
broadcast 192.168.1.255
