Exporting rules from nftables

Exporting rules from nftables

The upcoming nftables will slowly grow in the upcoming years, with the goal to become the succesor of iptables. Where iptables rules are harder to parse, nftables comes by default with an exporting facility in JSON or XML.

Command syntax

When using the command line utility nft for the first time, it looks a little bit unfriendly to the user. No suggestions on what to do, nor clear help on often used commands.. To save you some time, we look into nftables and document them for easy access later on.

We are sure the utilities of nftables, with nft in particular, will get some work in the upcoming releases.

Exporting rules

The tool nft has an export option, followed by the format to export. Right now it support both JSON or XML. These formats are common and very easy to parse.

Simply use the following commands:

# nft export xml
# nft export json
screenshot of nftables export with nft export xml

Exporting nftables rules with nft export xml

Importing nftables rules

At this moment there is no import function yet. According to the documentation this will be implemented in the upcoming releases. Clearly a useful option for sharing rules over many systems. One great example is the proposed nf-sync utility, which replicates nftables rules.

Lynis Enterprise

Lynis Enterprise screenshot to help with system hardening

This blog post is part of our Linux security series and the mission to get Linux and Unix-based systems more secure.

Does system hardening take a lot of time, or do you have any compliance in your company? Have a look at Lynis Enterprise.

Or start today with the open source security scanner Lynis (GitHub)

Leave a Reply

Your email address will not be published. Required fields are marked *