nftables

The google/nftables repository is a Go library that provides a high-level interface for interacting with the Linux nftables firewall. It allows users to programmatically manage firewall rules, sets, and other nftables objects using Go code, abstracting away the complexities of the low-level nftables API.

Pros

• Simplifies nftables management with a user-friendly Go API
• Provides type-safe operations and rule creation
• Supports a wide range of nftables features and objects
• Maintained by Google, ensuring reliability and regular updates

Cons

• Limited to Linux systems, as nftables is a Linux-specific firewall
• Requires root privileges or appropriate capabilities to modify firewall rules
• May have a learning curve for users unfamiliar with nftables concepts
• Documentation could be more comprehensive for advanced use cases

Code Examples

1. Creating a simple rule to allow incoming SSH traffic:

conn, _ := nftables.New()

table := &nftables.Table{Name: "filter", Family: nftables.TableFamilyINet}
chain := &nftables.Chain{Name: "input", Table: table}

conn.AddTable(table)
conn.AddChain(chain)

conn.AddRule(&nftables.Rule{
    Table: table,
    Chain: chain,
    Exprs: []expr.Any{
        &expr.Meta{Key: expr.MetaKeyL4PROTO, Register: 1},
        &expr.Cmp{
            Op:       expr.CmpOpEq,
            Register: 1,
            Data:     []byte{unix.IPPROTO_TCP},
        },
        &expr.Payload{
            DestRegister: 1,
            Base:         expr.PayloadBaseTransportHeader,
            Offset:       0,
            Len:          2,
        },
        &expr.Cmp{
            Op:       expr.CmpOpEq,
            Register: 1,
            Data:     []byte{0, 22}, // SSH port (22) in big-endian
        },
        &expr.Verdict{Kind: expr.VerdictAccept},
    },
})

conn.Flush()

2. Creating a set and adding elements to it:

conn, _ := nftables.New()

table := &nftables.Table{Name: "filter", Family: nftables.TableFamilyINet}
conn.AddTable(table)

set := &nftables.Set{
    Name:    "allowed_ips",
    Table:   table,
    KeyType: nftables.TypeIPAddr,
}
conn.AddSet(set, []nftables.SetElement{
    {Key: net.ParseIP("192.168.1.1").To4()},
    {Key: net.ParseIP("10.0.0.1").To4()},
})

conn.Flush()

3. Deleting a chain:

conn, _ := nftables.New()

table := &nftables.Table{Name: "filter", Family: nftables.TableFamilyINet}
chain := &nftables.Chain{Name: "custom_chain", Table: table}

conn.DelChain(chain)
conn.Flush()

Getting Started

To use the google/nftables library in your Go project:

1. Install the library:

   go get github.com/google/nftables
   

2. Import the library in your Go code:

   import "github.com/google/nftables"
   

3. Create a new nftables connection:

   conn, err := nftables.New()
   if err != nil {
       log.Fatalf("Failed to create nftables connection: %v", err)
   }
   

4. Use the conn object to interact with nftables, adding tables, chains, rules, etc.

5. Remember to call conn.Flush() to apply your changes to the firewall.