{{indexmenu_n>5}}
====== ACL rules with nftables ======

The routing daemon runs in a separate network namespace (''router'' in the examples), so access to rib interfaces must be restricted with firewall rules inside this netns. firewalld is not suitable for this: it cannot be run as a second instance in another netns and managed with ''firewall-cmd''. Therefore, rules for the router netns are set directly with nftables. Below, they are loaded at system startup by a separate systemd unit.

<note>firewalld must use nftables as its backend: the ''FirewallBackend=nftables'' parameter in ''/etc/firewalld/firewalld.conf''.\\
All commands are run as root (via ''sudo'').</note>

===== Step 1. Create the rules file =====

File: ''/etc/nftables/bgp-allow.nft''. The file name can be anything; it is specified later in the systemd unit.

<code>
#!/usr/sbin/nft -f

flush ruleset

# IP addresses of BGP peers allowed to connect
define bgp_ipv4_peers = {
    172.16.25.168
}

table inet filter {
    chain INPUT {
        type filter hook input priority filter; policy drop;

        ct state established,related accept
        iif lo accept

        # Allow all traffic from BGP peers
        ip saddr $bgp_ipv4_peers accept

        # Stricter option: allow only BGP (TCP 179) from peers
        #tcp dport 179 ip saddr $bgp_ipv4_peers accept
    }
}
</code>

<note important>The chain policy is ''drop'': everything that is not explicitly allowed is dropped. If other protocols are used in the router netns, add rules that allow them. For example:
  * for OSPF — ''ip protocol ospf accept'';
  * for IPv6 — ''meta l4proto ipv6-icmp accept'', otherwise Neighbor Discovery stops working.
</note>

<note>The ''flush ruleset'' command clears rules only in the netns where the file is executed. The main system rules are not affected.</note>

===== Step 2. Restrict file permissions =====

<code>
chmod 600 /etc/nftables/bgp-allow.nft
</code>

===== Step 3. Create a systemd unit =====

File: ''/etc/systemd/system/nftables.netns.service''

<code>
[Unit]
Description=nftables rules for netns router
Documentation=man:nft(8)
# Unit that starts the routing daemon in netns router
Wants=bird.netns.service
After=bird.netns.service

[Service]
Type=oneshot
ProtectSystem=full
ProtectHome=true
# Specify the file name from step 1 and the netns name from the router_netns parameter
ExecStart=/sbin/ip netns exec router /usr/sbin/nft -f /etc/nftables/bgp-allow.nft
ExecReload=/sbin/ip netns exec router /usr/sbin/nft 'flush ruleset; include "/etc/nftables/bgp-allow.nft";'
ExecStop=/sbin/ip netns exec router /usr/sbin/nft flush ruleset
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target
</code>

===== Step 4. Reload the systemd configuration =====

<code>
systemctl daemon-reload
</code>

===== Step 5. Start the unit and enable it at startup =====

<code>
systemctl enable --now nftables.netns.service
</code>

===== Step 6. Check that the rules are loaded in the router netns =====

<code>
ip netns exec router nft list ruleset
</code>