Found extra tables in nft ruleset

Found extra tables in nft ruleset

[Lars Noodén]

It's looking like nft is creating some extra tables when I create a chain.

Seen below, I can clear the ruleset and then create a table and only the
table I created is in the otherwise empty ruleset.  However, if I add a
chain to that table, then two unasked for tables get created, but
perhaps not used.  I'm not sure if they are supposed to be there or if
they should be used.

Is this an error on my part?  If so what?

Thanks,
Lars

# uname -sr
Linux 4.19.97-v7l+

# nft --version
nftables v0.9.0 (Fearless Fosdick)

# nft flush ruleset

# nft list ruleset

# nft add table ip foobar

# nft list ruleset
table ip foobar {
}

# nft add chain foobar output  { type filter hook output priority 0 \;
policy drop \; }

# nft list ruleset
table ip foobar {
        chain output {
                type filter hook output priority 0; policy drop;
        }
}
table ip filter {
        chain INPUT {
                type filter hook input priority 0; policy accept;
        }

        chain FORWARD {
                type filter hook forward priority 0; policy accept;
        }

        chain OUTPUT {
                type filter hook output priority 0; policy accept;
        }
}
table ip6 filter {
        chain INPUT {
                type filter hook input priority 0; policy accept;
        }

        chain FORWARD {
                type filter hook forward priority 0; policy accept;
        }

        chain OUTPUT {
                type filter hook output priority 0; policy accept;
        }
}

Re: Found extra tables in nft ruleset

[Florian Westphal]

Lars Noodén <lars.nooden@gmx.com> wrote:
> It's looking like nft is creating some extra tables when I create a chain.
> 
> Seen below, I can clear the ruleset and then create a table and only the
> table I created is in the otherwise empty ruleset.  However, if I add a
> chain to that table, then two unasked for tables get created, but
> perhaps not used.  I'm not sure if they are supposed to be there or if
> they should be used.

THey are not supposed to be there.

> Is this an error on my part?  If so what?

Run 'nft monitor' to figure out what adds them.
 

Re: Found extra tables in nft ruleset

[Lars Noodén]

[...]
> THey are not supposed to be there.
>
>> Is this an error on my part?  If so what?
>
> Run 'nft monitor' to figure out what adds them.

Thanks.

If I clear the ruleset and wait, while watching 'nft monitor' I get the
following.

# new generation 951 by process 4497 (nft)
add table ip filter
add chain ip filter INPUT { type filter hook input priority 0; policy
accept; }
add chain ip filter FORWARD { type filter hook forward priority 0;
policy accept; }
add chain ip filter OUTPUT { type filter hook output priority 0; policy
accept; }
# new generation 952 by process 4510 (iptables)
# new generation 953 by process 4510 (iptables)
add table ip6 filter
add chain ip6 filter INPUT { type filter hook input priority 0; policy
accept; }
add chain ip6 filter FORWARD { type filter hook forward priority 0;
policy accept; }
add chain ip6 filter OUTPUT { type filter hook output priority 0; policy
accept; }
# new generation 954 by process 4512 (ip6tables)
# new generation 955 by process 4512 (ip6tables)
# new generation 956 by process 4514 (iptables)
# new generation 957 by process 4514 (iptables)
# new generation 958 by process 4516 (ip6tables)
# new generation 959 by process 4516 (ip6tables)
... and so on ...

However, I can't seem to find anything obviously calling ip6tables, the
processes are quite short lived.  Then I search for ip6tables in a
script or (ugh) unit file, for example:

# grep -r ip6tables /lib/systemd/*
# grep -r ip6tables /etc/*

Both greps turn up nothing, but something is running and modifying
nftables frequently.  It's probably related to the distro so I will dig
into that, if the cause is not already known.

/Lars

Re: Found extra tables in nft ruleset

[Lars Noodén]

Using 'nft monitor' solved that: It appears that the extra tables were
added by iptables, which is in Raspbian Buster by default in the package
of the same name:

$ grep -i pretty /etc/os-release
PRETTY_NAME="Raspbian GNU/Linux 10 (buster)"

$ apt-cache policy iptables | head -n 3
iptables:
  Installed: 1.8.2-4
  Candidate: 1.8.2-4

iptables interferes with nft.  Uninstalling it package leaves nftables
alone to create new tables without getting extra, unasked for tables.

$ sudo nft add table ip foobar

$ sudo nft list ruleset
table ip foobar {
}

All set.  Thanks.

/Lars