Sample Header Ad - 728x90

How to add and delete a temporary nftables accept rule

2 votes
2 answers
2486 views
To get and renew a Letsencrypt certificate, I need to open the http port 80 while certbot is running, and close it afterwards. (There is no normal web service in this server). With iptables I used these commands in the letsencrypt "/etc/letsencrypt/renewal-hooks/pre" and ".../post" scripts:
iptables -I INPUT -p tcp --dport 80 -j ACCEPT -m comment --comment "Allow HTTP for certbot"
and
iptables -D INPUT -p tcp --dport 80 -j ACCEPT -m comment --comment "Allow HTTP for certbot"
I can use iptables-translate with the first -I(nsert) rule to get the equivalent nft command:
nft insert rule ip filter INPUT tcp dport 80 counter accept comment \"Allow HTTP for certbot\"
But with the -D(elete) command, I just get
Translation not implemented
So what would be the best way to implement this with nftables? Maybe I could also add and then remove an entire special table for that with nft add table ... and nft delete table ... ? But how to make sure that packets are not dropped anyway by my other table wich has policy drop?
Asked by mivk (3886 rep)
Dec 14, 2022, 03:41 PM
Last activity: Dec 22, 2022, 08:57 PM