Sample Header Ad - 728x90

nftables query interface address

0 votes
0 answers
58 views
Is it possible to query interface address using nftables? For example,
ip daddr = ifname_addr "eth0" counter accept
Consider a system that has 4 interfaces: eth0 eth1 eth2 eth3. It is desirable to isolate eth0 from eth3, but not from eth1 eth2. To implement it, traffic coming from eth0 needs to be rejected in case its destination address belongs to eth3. For example,
iifname "eth0" ip daddr eth3.ip.4.address counter reject
This implies that the address of eth3 is known in advance, but this might not be the case. Does nftables provide any tools to deal with this kind of situation? **EDIT** There was a confusion due to my uneducated phrasing of the question. Consider a system with 3 interfaces.
eth0 172.0.0.1/24
eth1 172.0.1.1/24
eth2 172.0.2.1/24
Consider a machine named X that is connected to eth0 together with you. If X uses you as a gateway to reach e.g. 172.0.1.10, then the traffic flows through the forwarding chain in netfilter. This traffic is easily filtered using the forward hook in nftables. On the other hand, if X tries to reach 172.0.1.1, the traffic will be processed by the input chain in netfilter. Due to Linux using the weak host model, the traffic will not even touch the eth1 interface, i.e. it will arrive on eth0 and leave through eth0 despite formally accessing IP address that is assigned to eth1. Consider that you want to prevent X from accessing the address assigned to eth2, but do not mind it accessing the address assigned to eth1. It can be done using the following rule in the input hook
iifname "eth0" ip daddr 172.0.2.1 counter reject
I was wondering if the same could be done without knowing the assigned address of eth2 in advance.
Asked by EmErAJID (26 rep)
Jun 1, 2025, 05:18 PM
Last activity: Jun 2, 2025, 07:35 AM