nftables is the current implementation, iptables is now just a
translation layer from the historical iptables interface. You can use whichever interface you prefer.
On Wed, 6 Aug 2025 11:38:12 +0100, Mike Scott wrote:
pf's tables - a list of ip addresses you treat within the rules as a
group, and change on the fly as desired. (pfctl -t inboundblock -T
add 1.2.3.0/24; pfctl -t inboundblock -T show). If something similar
is available, I certainly couldn't find it.
I think they’re called “sets” <https://manpages.debian.org/nftables(8)#SETS>. You can have named ones and anonymous ones.
Note also the subsequent sections on “maps” and “elements”.
For someone trying to get to grips with this, how does it help to
have a plethora of alternatives, a mound of interfaces, and - let's
face it - an awful lot of poor documentation around.
That’s why you have the more-user-friendly front ends like those
described in the article I originally referenced.
I don’t know. I’m just able to read documentation. I thought that was a skill that was so commonplace among folks who work with computers for a living that you could take it for granted, but apparently not.
On 11/08/2025 23:02, Lawrence D'Oliveiro wrote:
I don’t know. I’m just able to read documentation. I thought that was a >> skill that was so commonplace among folks who work with computers for a
living that you could take it for granted, but apparently not.
The horror is manuals written by the code-writer. They describe in
intimate detail each and every function; but not how it all hooks up. In
this case, I'd not even seen the nft man page, because I'd been
searching for the wrong terms, hadn't got there because I'd got drowned
in a morass of ipfilter and similar stuff, now apparently out-of-date;
and gave it up as a bad job.
What's wrong with a couple of clear examples, plus the detail to expand
on them?
On 11/08/2025 23:02, Lawrence D'Oliveiro wrote:
I don’t know. I’m just able to read documentation. I thought that was a >> skill that was so commonplace among folks who work with computers for a
living that you could take it for granted, but apparently not.
The horror is manuals written by the code-writer. They describe in
intimate detail each and every function; but not how it all hooks up. In
this case, I'd not even seen the nft man page, because I'd been
searching for the wrong terms, hadn't got there because I'd got drowned
in a morass of ipfilter and similar stuff, now apparently out-of-date;
and gave it up as a bad job.
What's wrong with a couple of clear examples, plus the detail to expand
on them?
I have the feeling you didn’t even bother doing a web search, because ...
On Wed, 6 Aug 2025 12:46:30 +0200, Carlos E.R. wrote:
I don't trust my router, provided by the ISP.
I bought my own. I could even run my own routing stack on a Linux box.
On 11/08/2025 23:02, Lawrence D'Oliveiro wrote:
I don’t know. I’m just able to read documentation. I thought that was a >> skill that was so commonplace among folks who work with computers for a
living that you could take it for granted, but apparently not.
The horror is manuals written by the code-writer. They describe in
intimate detail each and every function; but not how it all hooks up. In
this case, I'd not even seen the nft man page, because I'd been
searching for the wrong terms, hadn't got there because I'd got drowned
in a morass of ipfilter and similar stuff, now apparently out-of-date;
and gave it up as a bad job.
What's wrong with a couple of clear examples, plus the detail to expand
on them?
On 2025-08-12 09:39, Mike Scott wrote:
On 11/08/2025 23:02, Lawrence D'Oliveiro wrote:
I don’t know. I’m just able to read documentation. I thought that was a >>> skill that was so commonplace among folks who work with computers for a
living that you could take it for granted, but apparently not.
The horror is manuals written by the code-writer. They describe in
intimate detail each and every function; but not how it all hooks up.
In this case, I'd not even seen the nft man page, because I'd been
searching for the wrong terms, hadn't got there because I'd got
drowned in a morass of ipfilter and similar stuff, now apparently out-
of-date; and gave it up as a bad job.
What's wrong with a couple of clear examples, plus the detail to
expand on them?
+1
On 2025-08-20, Lawrence D’Oliveiro wrote:
On Tue, 19 Aug 2025 12:41:46 +0200, Carlos E.R. wrote:
On 2025-08-07 01:56, Lawrence D'Oliveiro wrote:
On Wed, 6 Aug 2025 12:46:30 +0200, Carlos E.R. wrote:
I don't trust my router, provided by the ISP.
I bought my own. I could even run my own routing stack on a Linux box.
The configuration needed by the ISP on the router is not documented ...
Here in NZ it’s all standard protocols. I bought the router from a local >> retailer, not from the ISP. Setup was straightforward -- the router calls
the setup option I am using “Dynamic IP”, but I think it’s just DHCP.
In this case, I think we're talking about a box with router and a bunch
of other stuff, to deal with incoming GPON (can this part still be
called modem, or the workings of fiber disqualify that?)
and at least
outgoing coax for TV, RJ11 for telephony and 8p8c for Ethernet.
I've seen these called "ONT", but it seems (from another thread here)
that this may not be entirely appropriate either?
On Tue, 19 Aug 2025 12:35:53 +0200, Carlos E.R. wrote:
What's wrong with a couple of clear examples, plus the detail to expand+1
on them?
There’s a whole website devoted to that, as I mentioned elsewhere.
On Wed, 20 Aug 2025 12:52:56 +0200, Carlos E.R. wrote:
On 2025-08-20 03:01, Lawrence D’Oliveiro wrote:
On Tue, 19 Aug 2025 12:35:53 +0200, Carlos E.R. wrote:
What's wrong with a couple of clear examples, plus the detail to+1
expand on them?
There’s a whole website devoted to that, as I mentioned elsewhere.
Not good enough, it should be inside the manuals.
The man page has examples, too. Naturally a tutorial/wiki site has more.
Remember what reference documentation is for: it’s to act, no more and no less, as the definitive reference to all the details of functionality, not
to offer hand-holding tutorial recipes for every conceivable thing you
might want to do with that functionality.
I do not want reference documentation.
I primarily want documentation that allows me to start using a new
program, fast, and to achieve my goals.
Once I have that, I want the reference documentation.
On 21/08/2025 10:44, Carlos E.R. wrote:
I do not want reference documentation.
I primarily want documentation that allows me to start using a new
program, fast, and to achieve my goals.
Once I have that, I want the reference documentation.
+1001
On 2025-08-21, Carlos E.R. wrote:
On 2025-08-21 12:34, The Natural Philosopher wrote:[...]
On 21/08/2025 10:44, Carlos E.R. wrote:
I do not want reference documentation.
I primarily want documentation that allows me to start using a new
program, fast, and to achieve my goals.
Once I have that, I want the reference documentation.
+1001
To that I added "bird.avi" as output file, but WhatsApp rejected
it. So I told ChatGpt all that. It replied giving me the missing data:
ffmpeg -i IMAG0009.avi -vf "scale=640:-2" -c:v libx264 -profile:v \
baseline -level 3.0 -preset fast -c:a aac -b:a 128k \
-movflags +faststart bird_whatsapp.mp4
and that worked. Having that command line, I modified it easily for
more resolution (scale=1024:-2). I was already familiar with all the
options, I just needed to find which would produce the wanted result,
and not spend a day on it.
But if I want to find in the manual what "-b" stands for, I fail. Ask
chatgpt, instant reply, it is bitrate. Oh, yes, I remember now.
:-)
Oh, searching the man for "movflags" or "faststart" fails. So ask the
AI. They are in the man page for the MP3 muxer, it says. Oh, right, I
forgot that.
So, even a reference manual is hard to use when you want to find a
particular reference, basically using "grep".
(ffmpeg's online manual is spread over more than one page, isn't it?)
Having been pointed at nftables as the right direction, I had a word
with chatgpt asking for examples for my use case. I treat the answers
with suspicion, but they seem clear and reasonable, and I'll take a good
look when I've time.
(I'd given up on chatgpt ages ago, when it made Noddy mistakes on
trivial code examples. Looks like things have improved since then.)
Thanks all for helpful answers.
On Wed, 27 Aug 2025 06:56:46 +0100, Mike Scott wrote:troff:<standard input>:1317: warning [p 10, 4.7i, div '3tbd9,1', 0.3i]:
pf allows, for example
pfctl -t inboundblock -T replace -f /etc/firewall/inboundblock
which is an atomic operation.
The docs say
nft -f «file»
is an atomic operation. You might have known that if you’d read them.
man nft |grep atomic
On Fri, 29 Aug 2025 00:56:54 -0000 (UTC)
Lawrence D’Oliveiro <ldo@nz.invalid> wrote:
To be fair, the online wiki does give the answer. Which raises the
issue, again, of documentation standards. When important matters are
absent from at least some key docs, then what?
Weren’t you one of those complaining that bare reference material
wasn’t enough? That you wanted tutorial examples and how-tos and all
that? Then when I mention that it all that is available, you now find
a new reason to complain?
Again, when important information for *core networking tools* is only
found on the Web, it hardly takes a great sage to discern the problem.
On 2025-08-30, Lawrence D’Oliveiro wrote:
On Fri, 29 Aug 2025 08:10:08 -0700, John Ames wrote:
On Fri, 29 Aug 2025 00:56:54 -0000 (UTC)
Lawrence D’Oliveiro <ldo@nz.invalid> wrote:
Weren’t you one of those complaining that bare reference material
wasn’t enough? That you wanted tutorial examples and how-tos and
all that? Then when I mention that it all that is available, you
now find a new reason to complain?
Again, when important information for *core networking tools* is
only found on the Web, it hardly takes a great sage to discern the
problem.
The problem is, you don’t understand the Web?
Because *everything* is on the Web these days. If you can’t figure out
basic Web searching, then perhaps you should stay away from computers
altogether?
If there's no network connectivity, your web search skills won't do
much?
On 29/08/2025 16:10, John Ames wrote:
On Fri, 29 Aug 2025 00:56:54 -0000 (UTC)
Lawrence D’Oliveiro <ldo@nz.invalid> wrote:
To be fair, the online wiki does give the answer. Which raises the
issue, again, of documentation standards. When important matters are
absent from at least some key docs, then what?
Weren’t you one of those complaining that bare reference material
wasn’t enough? That you wanted tutorial examples and how-tos and all
that? Then when I mention that it all that is available, you now find
a new reason to complain?
Again, when important information for *core networking tools* is only
found on the Web, it hardly takes a great sage to discern the problem.
The problem is that it is /not/ all available. I'm quite stumped about
one particular issue for which there seem no references at all that I
can find: and believe me, I have looked.
Ironically, chatgpt has been a help. It makes so many errors that
sorting them out has been quite educational.
Oh - the problem in hand. No doubt it's easy when you know: single
interface, allow all lan traffic, block wan inbound to port 22, redirect
wan inbound on port 12345 to 22 and pass. Block wan inbound otherwise.
If anyone has a config snippet to do this, I'd be very grateful.
On 29.8.2025 21.16, Mike Scott wrote:
On 29/08/2025 16:10, John Ames wrote:
On Fri, 29 Aug 2025 00:56:54 -0000 (UTC)
Lawrence D’Oliveiro <ldo@nz.invalid> wrote:
To be fair, the online wiki does give the answer. Which raises the
issue, again, of documentation standards. When important matters are >>>>> absent from at least some key docs, then what?
Weren’t you one of those complaining that bare reference material
wasn’t enough? That you wanted tutorial examples and how-tos and all >>>> that? Then when I mention that it all that is available, you now find
a new reason to complain?
Again, when important information for *core networking tools* is only
found on the Web, it hardly takes a great sage to discern the problem.
The problem is that it is /not/ all available. I'm quite stumped about
one particular issue for which there seem no references at all that I
can find: and believe me, I have looked.
Ironically, chatgpt has been a help. It makes so many errors that
sorting them out has been quite educational.
Oh - the problem in hand. No doubt it's easy when you know: single
interface, allow all lan traffic, block wan inbound to port 22,
redirect wan inbound on port 12345 to 22 and pass. Block wan inbound
otherwise. If anyone has a config snippet to do this, I'd be very
grateful.
Mike,
The tool you need is called nftables, with a command line
interface program called nft.
Google for nftables documentation, read and understand it, the
response is there with examples. It is difficult to provide a
good snippet without your networking details.
You could also configure the ssh daemon with a secondary port
of 12345, just pass it, to avoid the port translation step.
On 30/08/2025 14:59, Tauno Voipio wrote:
On 29.8.2025 21.16, Mike Scott wrote:
On 29/08/2025 16:10, John Ames wrote:
On Fri, 29 Aug 2025 00:56:54 -0000 (UTC)
Lawrence D’Oliveiro <ldo@nz.invalid> wrote:
To be fair, the online wiki does give the answer. Which raises the >>>>>> issue, again, of documentation standards. When important matters are >>>>>> absent from at least some key docs, then what?
Weren’t you one of those complaining that bare reference material
wasn’t enough? That you wanted tutorial examples and how-tos and all >>>>> that? Then when I mention that it all that is available, you now find >>>>> a new reason to complain?
Again, when important information for *core networking tools* is only
found on the Web, it hardly takes a great sage to discern the problem. >>>>
The problem is that it is /not/ all available. I'm quite stumped
about one particular issue for which there seem no references at all
that I can find: and believe me, I have looked.
Ironically, chatgpt has been a help. It makes so many errors that
sorting them out has been quite educational.
Oh - the problem in hand. No doubt it's easy when you know: single
interface, allow all lan traffic, block wan inbound to port 22,
redirect wan inbound on port 12345 to 22 and pass. Block wan inbound
otherwise. If anyone has a config snippet to do this, I'd be very
grateful.
Mike,
The tool you need is called nftables, with a command line
interface program called nft.
Google for nftables documentation, read and understand it, the
response is there with examples. It is difficult to provide a
good snippet without your networking details.
You could also configure the ssh daemon with a secondary port
of 12345, just pass it, to avoid the port translation step.
We're going in circles here.... there's an issue with lack of decent
docs (and examples) for nft - it seems that port blocking occurs after
the redirection, with unhappy consequences, and I find no usable
information suggesting any other possibility.
I have running on freebsd, and am trying to move to linux, a server that ignores port 22 from the net at large, but accepts (similar to) 12345,
just to provide an extra layer of obfuscation to wannabe attackers.
It's a 2-line doddle on freebsd's pf firewall; I can't for the life of
me work out the nftables equivalent, and begin to wonder if indeed it
can be done.
I suppose opening multiple ssh listener ports is another solution
(thanks), but the original problem should - surely - be solvable: it
also pops up for other services but which won't necessarily have the workaround.
On 30.8.2025 20.45, Mike Scott wrote:
On 30/08/2025 14:59, Tauno Voipio wrote:
On 29.8.2025 21.16, Mike Scott wrote:
On 29/08/2025 16:10, John Ames wrote:
On Fri, 29 Aug 2025 00:56:54 -0000 (UTC)
Lawrence D’Oliveiro <ldo@nz.invalid> wrote:
To be fair, the online wiki does give the answer. Which raises the >>>>>>> issue, again, of documentation standards. When important matters are >>>>>>> absent from at least some key docs, then what?
Weren’t you one of those complaining that bare reference material >>>>>> wasn’t enough? That you wanted tutorial examples and how-tos and all >>>>>> that? Then when I mention that it all that is available, you now find >>>>>> a new reason to complain?
Again, when important information for *core networking tools* is only >>>>> found on the Web, it hardly takes a great sage to discern the problem. >>>>>
The problem is that it is /not/ all available. I'm quite stumped
about one particular issue for which there seem no references at all
that I can find: and believe me, I have looked.
Ironically, chatgpt has been a help. It makes so many errors that
sorting them out has been quite educational.
Oh - the problem in hand. No doubt it's easy when you know: single
interface, allow all lan traffic, block wan inbound to port 22,
redirect wan inbound on port 12345 to 22 and pass. Block wan inbound
otherwise. If anyone has a config snippet to do this, I'd be very
grateful.
Mike,
The tool you need is called nftables, with a command line
interface program called nft.
Google for nftables documentation, read and understand it, the
response is there with examples. It is difficult to provide a
good snippet without your networking details.
You could also configure the ssh daemon with a secondary port
of 12345, just pass it, to avoid the port translation step.
We're going in circles here.... there's an issue with lack of decent
docs (and examples) for nft - it seems that port blocking occurs after
the redirection, with unhappy consequences, and I find no usable
information suggesting any other possibility.
I have running on freebsd, and am trying to move to linux, a server
that ignores port 22 from the net at large, but accepts (similar to)
12345, just to provide an extra layer of obfuscation to wannabe
attackers.
It's a 2-line doddle on freebsd's pf firewall; I can't for the life of
me work out the nftables equivalent, and begin to wonder if indeed it
can be done.
I suppose opening multiple ssh listener ports is another solution
(thanks), but the original problem should - surely - be solvable: it
also pops up for other services but which won't necessarily have the
workaround.
I'm writing this just on a network, where the Linux router is having
a ruleset resembling what you ask for.
Please look at <https://wiki.nftables.org/wiki-nftables/index.php/ Netfilter_hooks>
The nftables pages contain the information you need.
You need to block the inbound TCP port 22 coming from the external
interface. The correct place is in the ip nat table, PREROUTING chain.
| Sysop: | Keyop |
|---|---|
| Location: | Huddersfield, West Yorkshire, UK |
| Users: | 546 |
| Nodes: | 16 (0 / 16) |
| Uptime: | 167:21:39 |
| Calls: | 10,385 |
| Calls today: | 2 |
| Files: | 14,057 |
| Messages: | 6,416,533 |