ACL rules with nftables
The routing daemon runs in a separate network namespace (router in the examples), so access to rib interfaces must be restricted with firewall rules inside this netns. firewalld is not suitable for this: it cannot be run as a second instance in another netns and managed with firewall-cmd. Therefore, rules for the router netns are set directly with nftables. Below, they are loaded at system startup by a separate systemd unit.
firewalld must use nftables as its backend: the
All commands are run as root (via
FirewallBackend=nftables parameter in /etc/firewalld/firewalld.conf.All commands are run as root (via
sudo).
Step 1. Create the rules file
File: /etc/nftables/bgp-allow.nft. The file name can be anything; it is specified later in the systemd unit.
#!/usr/sbin/nft -f
flush ruleset
# IP addresses of BGP peers allowed to connect
define bgp_ipv4_peers = {
172.16.25.168
}
table inet filter {
chain INPUT {
type filter hook input priority filter; policy drop;
ct state established,related accept
iif lo accept
# Allow all traffic from BGP peers
ip saddr $bgp_ipv4_peers accept
# Stricter option: allow only BGP (TCP 179) from peers
#tcp dport 179 ip saddr $bgp_ipv4_peers accept
}
}
The chain policy is
drop: everything that is not explicitly allowed is dropped. If other protocols are used in the router netns, add rules that allow them. For example:- for OSPF —
ip protocol ospf accept; - for IPv6 —
meta l4proto ipv6-icmp accept, otherwise Neighbor Discovery stops working.
The
flush ruleset command clears rules only in the netns where the file is executed. The main system rules are not affected.
Step 2. Restrict file permissions
chmod 600 /etc/nftables/bgp-allow.nft
Step 3. Create a systemd unit
File: /etc/systemd/system/nftables.netns.service
[Unit] Description=nftables rules for netns router Documentation=man:nft(8) # Unit that starts the routing daemon in netns router Wants=bird.netns.service After=bird.netns.service [Service] Type=oneshot ProtectSystem=full ProtectHome=true # Specify the file name from step 1 and the netns name from the router_netns parameter ExecStart=/sbin/ip netns exec router /usr/sbin/nft -f /etc/nftables/bgp-allow.nft ExecReload=/sbin/ip netns exec router /usr/sbin/nft 'flush ruleset; include "/etc/nftables/bgp-allow.nft";' ExecStop=/sbin/ip netns exec router /usr/sbin/nft flush ruleset RemainAfterExit=yes [Install] WantedBy=multi-user.target
Step 4. Reload the systemd configuration
systemctl daemon-reload
Step 5. Start the unit and enable it at startup
systemctl enable --now nftables.netns.service
Step 6. Check that the rules are loaded in the router netns
ip netns exec router nft list ruleset
Was this information helpful?