From iptables to nftables - how to delete rules

[eeckwrk99]

I'm using a program that can be configured to use either iptables or nftables. I've been using iptables but now I'd like to switch to nftables.

When running, the program sets some rules. Some of these rules prevent my virtual machines (QEMU/KVM with virt-manager, using NAT) from having any Internet traffic.

Said rules (with iptables):

[pietinger]

Normally, a firewall works in such a way that everything that has not been expressly permitted is prohibited. (There are some special situations where you allow everything and only forbid some things, but forget that right away).

There is a POLICY in iptables AND nftables - and - there are DROP rules in iptables and nftables. Please do not confuse the two.

Now the question arises why you need a DROP rule if the policy already drops everything that was not previously allowed. A sensible use is, for example, if you want to know HOW MANY packets were dropped due to a special DROP rule.

But I don't understand your problem right now, because YOU have a standard DROP policy in both rule works ...

In general, however, I would recommend simply logging all DROPS and then checking the message log to see where you still need to allow something.
_________________
https://wiki.gentoo.org/wiki/User:Pietinger

[Hu]

Perhaps it would also be useful to configure this unidentified program not to write rules that conflict with other uses of the machine. Either make it add rules that keep the VM working, or prohibit it adding rules that break the VM.

[eeckwrk99]