[SOLVED] nftables errors stating unexpected ip6?

tmick · 05-23-2022, 07:26 PM

So I'm getting errors about an unexpected ip6 in nftables when I run:

Code:

sudo nft -f /etc/nftables.conf
/etc/nftables.conf:41:3-5: Error: syntax error, unexpected ip6
		ip6 nexthdr ipv6 icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, echo-reply, echo-request, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, 148, 149 } accept
		^^^
/etc/nftables.conf:42:3-5: Error: syntax error, unexpected ip6
		ip6 saddr fe80::/10 icmpv6 type { 130, 131, 132, 143, 151, 152, 153 } accept
		^^^
/etc/nftables.conf:45:11-14: Error: syntax error, unexpected drop, expecting string
		counter drop
		        ^^^^

If I run:

Code:

sudo nft --check --file /etc/nftables.conf
/etc/nftables.conf:41:3-5: Error: syntax error, unexpected ip6
		ip6 nexthdr ipv6 icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, echo-reply, echo-request, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, 148, 149 } accept
		^^^
/etc/nftables.conf:42:3-5: Error: syntax error, unexpected ip6
		ip6 saddr fe80::/10 icmpv6 type { 130, 131, 132, 143, 151, 152, 153 } accept
		^^^
/etc/nftables.conf:45:11-14: Error: syntax error, unexpected drop, expecting string
		counter drop
		        ^^^^

In Debian it has example files and I also tried to use

Quote:

meta nfproto ipv6 icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, echo-reply, echo-request, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, 148, 149 } accept
ip6 saddr fe80::/10 icmpv6 type { 130, 131, 132, 143, 151, 152, 153 } accept

and it doesn't like that either, I get errors about an unexpected meta.
My nftables.conf looks like this

Code:

#!/usr/sbin/nft -f

flush ruleset

table inet filter {

chain base_checks {
        # Drop invalid connections and allow established/related connections
                ct state invalid drop
                ct state {established, related} accept
    }

        chain input {
                type filter hook input priority 0; policy drop;

        jump base_checks

        # Allow from loopback
                iifname lo accept
        iifname != lo ip daddr 127.0.0.1/8 drop

        # New UDP traffic will jump to the UDP chain
                ip protocol udp ct state new jump UDP
        # New TCP traffic will jump to the TCP chain
                tcp flags & (fin | syn | rst | ack) == syn ct state new jump TCP

        # Everything else
                ip protocol udp reject
                ip protocol tcp reject with tcp reset
        reject with icmpx type port-unreachable
        }

        chain forward {
                type filter hook forward priority 0; policy drop;
        } 

        chain output {
                type filter hook output priority 0; policy accept;
        }
		# ICMPv6 packets which must not be dropped, see https://tools.ietf.org/html/rfc4890#section-4.4.1
		ip6 nexthdr ipv6 icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, echo-reply, echo-request, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, 148, 149 } accept
		ip6 saddr fe80::/10 icmpv6 type { 130, 131, 132, 143, 151, 152, 153 } accept

		# count and drop any other traffic
		counter drop

# ---------------------------------------------------------------------------------
		##CHAIN RULES

    # TCP chain
    set TCP_accepted {
        type inet_service; flags interval; 
        elements = {1714-1764}
    }
        chain TCP {
        tcp dport @TCP_accepted accept
        } 

    # UDP chain
    set UDP_accepted {
        type inet_service; flags interval;
         elements = {1714-1764}
    }
        chain UDP {
        udp dport @UDP_accepted accept
        }
}

I'd love to know what I did wrong here, help is appreciated.

I also want to have enp1s0 (usually called eth0) and tun0 (my VPN) be able to trust each other but I can't find anything for the syntax of that any ideas?
I'm trying to get rid of these messages in my logs:

Code:

May 23 16:02:04 DebianTim kernel: [89979.947803] FW6 REJECT (input): IN=enp1s0 OUT= MAC=33:33:00:00:00:01:48:4e:fc:f0:69:b8:86:dd SRC=fe80:0000:0000:0000:4a4e:fcff:fef0:69b8 DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=168 TC=0 HOPLIMIT=255 FLOWLBL=356592 PROTO=ICMPv6 TYPE=134 CODE=0

darthaxul · 07-31-2022, 09:55 PM

looks like those lines 41,42,45 aren't in an enclosed chain bracket. try placing them in the chain bracket instead such as input