Is it possible to query interface address using
nftables
?
For example,
ip daddr = ifname_addr "eth0" counter accept
Consider a system that has 4 interfaces: eth0 eth1 eth2 eth3
. It is desirable to isolate eth0
from eth3
, but not from eth1 eth2
. To implement it, traffic coming from eth0
needs to be rejected in case its destination address belongs to eth3
. For example,
iifname "eth0" ip daddr eth3.ip.4.address counter reject
This implies that the address of eth3
is known in advance, but this might not be the case. Does nftables
provide any tools to deal with this kind of situation?
**EDIT**
There was a confusion due to my uneducated phrasing of the question. Consider a system with 3 interfaces.
eth0 172.0.0.1/24
eth1 172.0.1.1/24
eth2 172.0.2.1/24
Consider a machine named X
that is connected to eth0
together with you. If X
uses you as a gateway to reach e.g. 172.0.1.10
, then the traffic flows through the forwarding chain in netfilter. This traffic is easily filtered using the forward
hook in nftables.
On the other hand, if X
tries to reach 172.0.1.1
, the traffic will be processed by the input chain in netfilter. Due to Linux using the weak host model, the traffic will not even touch the eth1
interface, i.e. it will arrive on eth0
and leave through eth0
despite formally accessing IP address that is assigned to eth1
.
Consider that you want to prevent X
from accessing the address assigned to eth2
, but do not mind it accessing the address assigned to eth1
. It can be done using the following rule in the input
hook
iifname "eth0" ip daddr 172.0.2.1 counter reject
I was wondering if the same could be done without knowing the assigned address of eth2
in advance.
Asked by EmErAJID
(26 rep)
Jun 1, 2025, 05:18 PM
Last activity: Jun 2, 2025, 07:35 AM
Last activity: Jun 2, 2025, 07:35 AM