How to add and delete a temporary nftables accept rule
2
votes
2
answers
2486
views
To get and renew a Letsencrypt certificate, I need to open the http port 80 while
certbot
is running, and close it afterwards. (There is no normal web service in this server).
With iptables
I used these commands in the letsencrypt "/etc/letsencrypt/renewal-hooks/pre" and ".../post" scripts:
iptables -I INPUT -p tcp --dport 80 -j ACCEPT -m comment --comment "Allow HTTP for certbot"
and
iptables -D INPUT -p tcp --dport 80 -j ACCEPT -m comment --comment "Allow HTTP for certbot"
I can use iptables-translate
with the first -I
(nsert) rule to get the equivalent nft
command:
nft insert rule ip filter INPUT tcp dport 80 counter accept comment \"Allow HTTP for certbot\"
But with the -D
(elete) command, I just get
Translation not implemented
So what would be the best way to implement this with nftables?
Maybe I could also add and then remove an entire special table for that with nft add table ...
and nft delete table ...
? But how to make sure that packets are not dropped anyway by my other table wich has policy drop
?
Asked by mivk
(3886 rep)
Dec 14, 2022, 03:41 PM
Last activity: Dec 22, 2022, 08:57 PM
Last activity: Dec 22, 2022, 08:57 PM