Replace iptables with nftables

[murgero]

@girish I don't expect that to take too much time too, UFW's backend is iptables so really just sorting out the UFW cli / api should be relatively simple****

[yusf]

@girish Is it happening? Was looking to customize some settings but I'm not touching iptables.

[ariachris56]

Glad to know about it.

[will]

@girish UFW isn't really its own firewall, its a front end for iptables, and probably nftables.

[robi]

@girish the main issue with ufw is that is doesn't support managing any rules in specific chains. (for example the important INPUT chain or the custom CLOUDRON chain).

We need ways for at least this to be able to fully manage the range of apps and services we need.

[girish]

@robi In the recent release, we added a way to blacklist IPs and also whitelist additional ports. Do these two things cover most cases? https://docs.cloudron.io/networking/#firewall

[robi]

@girish ooh that's great! I knew about the blocklist (bye-bye .cn) but not the whitelist.

can you add a udp port example to the whitelist docs?

I keep struggling to keep mosh accessible after a cloudron reboot and it would make sense to simply add mosh support to the default install. (thoughts?)

It's also not clear if IP port ranges are supported in the whitelist. (mosh ports listed as: 60000-60010 or 60000:60010 didn't work.)

Do I need to list all the ports in the range?

Also, why does the cloudron-firewall restart take so long? 15-20secs is disturbingly long.

json is ugh, does it make sense to also convert it to plain text like the blocklist?

[girish]

@robi said in Replace iptables with nftables:

can you add a udp port example to the whitelist docs?

Currently, only tcp is supported. I will look into adding udp, it should be straightforward.

Also, why does the cloudron-firewall restart take so long? 15-20secs is disturbingly long.

I think that's the time the kernel is taking to add your blocklist to ipset. I imagine it's pretty big? How many entries does it have?

[robi]

Currently, only tcp is supported. I will look into adding udp, it should be straightforward.

Hmm, then why am I seeing some of the udp ports I added?

I also see iptables -L | grep 50000:51000
what is this for? looks like a typo for mosh (60000-61000)

I think that's the time the kernel is taking to add your blocklist to ipset. I imagine it's pretty big? How many entries does it have?

oh yes, 13,687 IPs in blocklist now (cn, ru), 25 seconds to load.

[girish]

@robi said in Replace iptables with nftables:

I also see iptables -L | grep 50000:51000

That's for the TURN server.

[robi]

ooh that's usable for mosh too with the -p parameter.

let's just make mosh a default thing please!

[robi]

I'm installing a new Cloudron and got bit by this again.. can't get mosh to work without manually tweaking iptables.

iptables -I INPUT 1 -p udp --dport 60000:60010 -j ACCEPT

[robi]

Ran into this again, with an easy solution since Cloudron already allows the TURN server port range, we can adopt it for mosh client side.

Simply explicitly ask for a starting port and it will connect:
mosh -p 50000 user@host

Otherwise server side: set the MOSH_PORT env var so mosh-server starts searching from port 50000:

# System-wide for all users
echo 'export MOSH_PORT=50000' | tee /etc/profile.d/mosh.sh