Single v6 IP within other /64 range: Error: conflicting intervals specified

[iso8601x]

I use nftfw on a VPS and today, when the system was rebooted, nftfw seemed to encounter a config error and seemed to default to a state where all inbound connections were permitted - I received a Shodan open port alert.

In whitelist.d I have a couple of /64 ranges. The problem seems to have been triggered because I had a single v6 IP in addition to a /64 range. The single v6 IP happened to be within one of the /64 ranges.

With the v6 IP file in whitelist.d, the error in nftfw load is as follows:

# nftfw load
nftfw[1119]: Loading data from /etc/nftfw
nftfw[1119]: Creating reference files in /var/lib/nftfw/build.d
nftfw[1119]: Testing new nftables installation
nftfw[1119]: Testing nft rulesets from nftfw_init.nft
nftfw[1119]: nft using /var/lib/nftfw/build.d/nftfw_init.nft: failed
nftfw[1119]: In file included from /var/lib/nftfw/build.d/nftfw_init.nft:182:1-29:
/var/lib/nftfw/build.d/whitelist_sets.nft:10:1-20: Error: conflicting intervals specified
<redacted: single IPv6 IP>:,
^^^^^^^^^^^^^^^^^^^^~~~
In file included from /var/lib/nftfw/build.d/nftfw_init.nft:182:1-29:
/var/lib/nftfw/build.d/whitelist_sets.nft:9:1-21: Error: Could not process rule: File exists
add element ip6 filter w_all {<redacted: IPv6 /64 range>,

After a reboot, this was the output of nft list ruleset:

table inet filter {
        chain input {
                type filter hook input priority filter; policy accept;
        }

        chain forward {
                type filter hook forward priority filter; policy accept;
        }

        chain output {
                type filter hook output priority filter; policy accept;
        }
}

When the single v6 IP is rm'd and then doing an nftfw load, the ruleset is then loaded correctly.

Hopefully I've explained this OK. Sorry if not.

Version: 0.9.13
Linux 5.10.0-23-amd64 #1 SMP Debian 5.10.179-1 (2023-05-12) x86_64 GNU/Linux

[pcollinson]

This is a problem where nftables in the kernel is reporting an error with the information you have supplied it. nftfw can only report the error, and doesn't know how to fix it, which you've done by removing the single IPv6 address.

The nft ruleset that you saw is the default setting when no nftables instructions have been found on reboot. It would be wise to ensure that /etc/nftables.conf is loaded by the nft command when the system reboots. On Debian, this is done by the nftables package. nftfw will not change /etc/nftables.conf when the test phase of the load process fails.

[syndicateops]

Good evening, I was just cleaning through various webserver accounts and came across some of the nftables advice i had gotten from you years back! nftfw If you are still around, i have a environmental nftables question if interested. I have a nice little ruleset that uses external IPSETs that define some trust levels in my rules. inspired in part by my use of nftfw i bet.. Then you introduce a pile of kubernettes hosts into the network & some adjustments are needed! have you worked much with nftables along side running kubernettes? it likes to manage it's own ruleset, forward traffic and similar. they can coexist i've found. ensuring it can manage it's traffic while still securing the host is one of my goals. I love working with nftables. it's been fun.

…

On 2023-05-17 14:06, Peter Collinson wrote: This is a problem where nftables in the kernel is reporting an error with the information you have supplied it. nftfw can only report the error, and doesn't know how to fix it, which you've done by removing the single IPv6 address. The nft ruleset that you saw is the default setting when no nftables instructions have been found on reboot. It would be wise to ensure that /etc/nftables.conf is loaded by nft when the system reboots. On Debian, this is done by the nftables package. -- Reply to this email directly, view it on GitHub [1], or unsubscribe [2]. You are receiving this because you are subscribed to this thread.Message ID: ***@***.***> Links: ------ [1] #9 (comment) [2] https://github.com/notifications/unsubscribe-auth/AKLQXVDQHCW6VRE3F5AYG3TXGTLM7ANCNFSM6AAAAAAYCP6NOI

[pcollinson]

have you worked much with nftables along side running kubernettes?

Sorry I have not.