Nftables and network traffic redirection

PLCnext Technology & PLCnext Controls
1

Hello team! I was trying to configure manually the nftables on AXC F 2152 in order to find a solution to redirect network traffic from one interface (eth0) to other (virtual eth0.0). It’s just an example of what I’m trying to do, but I face some problems/doubts along the way, maybe you could solve me some:

                                               * In order to edit nftables manually... files from /etc/nftables/ (like plcnext-filter or ipv4-nat) should be modified, isn't it?
                                               * When I modified any of this files, the changes have no effect. Need I restart any service or execute something for that?
                                               * When I modified any of this files, and after that I reboot the PLC, the firmware (or I suppose that...) overwrite the files to the original version. Is there any way to avoid that?
                                               * And finally, all these doubts have arisen because I am trying to redirect traffic that reaches the PLC through an ethernet network (i.e. 192.168.1.0) and redirect it to another network (i.e. 192.168.0.0). Is there any example or has anyone an idea about how to do it? Or if is it possible or not?

Thank you in advance for you support! Best regards.

2

Hello javirivela, the default files are managed via the web based management. As you already noticed they will be overwritten after a reboot. Please take a look into the PLCnext Technology User Manual in capter 3.9.3.2. A description how to add additional files is available there. handbook Kind regards, Marcel

3

Thank you Marcel for your answer! I was reading the manual but I haven’t seen how to create a new file to be read by nftables. Apart from that, I have another problem, when I tried the example that is in the manual, it works, but when I reboot the PLC I lose the new nftables configuration. Any help for that? Thank you! Best regards.

4

Hello,

the configuration files are simple textfiles that can be created with any editor.
You will properbly need root privileges to add them. About the second problem:
Could it be that nftables is not activated?
Where do you change the configuration?

5

Hello Oliver, Thanks again for your time :slight_smile: . I’m going to try to explain exactly what I’ve done step by step so that you can correct me if I have done something wrong or if I’ve skkiped a step. [list=1] [] Open the WBM of the controller. Click on section Security → Firewall. Select “Activation” (Activated: Firewall is started. After system restart the firewall will be activated). Press “Apply” button. [] Reboot PLC. [] Open the WBM of the controller. The current firewall status is “started”. Clicking on “Show rules” button it shows the default table configuration (Table: filter, Family: ip). [] Open SSH terminal. Login as root. Go to /etc/nftables/ directory and create a new file (i.e. load-filter) with the following content (same as the manual description): [quote] table ip loadfilter { chain input_limiter { type filter hook input priority 0; policy accept; icmp type echo-request limit rate 10/second burst 5 packets accept counter packets 6 bytes 539 } } [/quote] [] Excute the command nft -f load-filter; nft list tables After that, I have two tables: [quote]table ip filter table ip loadfilter[/quote] [] Open the WBM of the controller. The current firewall status is “started”. “System message” now shows [quote] Configuration status = OK Warning: Undefined Active Rules Tables => loadfilter [/quote] Clicking on “Show rules” button it shows both tables configuration (Table: filter, Family: ip, Table: loadfilter, Family: ip ). [] Reboot PLC. [] Excute the command nft list tables After that, I only have the default table: table ip filter [*] Open the WBM of the controller. The current firewall status is “started”. “System message” now shows only [quote] Configuration status = OK[/quote] Clicking on “Show rules” button it shows only the default table configuration (Table: filter, Family: ip). [/list] So every time that I reboot the PLC, I lose the configuration… I may be missing some step ??? Thank you!

6

Hello javirivela, looks like the startup behavior changed from when I last used it. I am sorry I was not aware of that. As it is now ,If the settings in the WBM do not suffice, I guess you will have to create a “Init.d” script and add it with “update.rc” to load your nftable rules at boot. But I still have to verify this answer with the development maybe there is a better way right now. There exist extensive tutorials on how to do that for linux. Something like: #!/bin/sh start(){ nft -f somefilter } .... case "$1" in start) start ;; stop) stop ;; restart) stop start ;; *) echo "Usage: $0 {start|stop|restart}" esac It would be nice to have a feature like “save current config” to easily save more complex filters. I will forward this as a requirement for future Versions. Maybe also a list of nfttable file “Includes” might be a viable solution. So you can load or unload entire config files #!/usr/sbin/nft -f include "ipv4-nat.ruleset" include "ipv6-nat.ruleset" Any thoughts on your side? Kind regards, Oliver

7

Hi Olvier, I’ve tried what you suggested and it’s works fine. It’s true that it’s not the best option… you need to create a new “daemon” script to do so, and it’s not easy to “undo” the new configuration (activate/deactive the new rules). As you said, maybe there is another way actually to do that, but at least, I don’t know it. I’m glad to know that you’re going to propose an improvement of this part for future developments (the idea of the includes list could be a good option). Thanks! Best regards.