Hello,
I am beating my head on the way trying to implement a vpn killswitch
with nftables. My configuration is below and I want to allow access to
my networks (192.168.0.0/24 which is working) as well as allowing vmware
to do it's thing over vmnet8 (which is also working). I am almost
certain this a "can't see the forest for the trees" issue at this point.
When the VPN connects and these rules are applied everything except the
VPN works as expected and if the rulese are not applied the VPN works as
expected.
#!/usr/sbin/nft -f
flush ruleset
table inet filter {
chain input {
type filter hook input priority 0; policy drop;
counter
ip protocol icmp accept
ct state {related, established } accept
ct state invalid drop
iif lo accept
iifname "enp3s0f1" jump input_enp3s0f1
iifname "wlp2s0" jump input_wlp2s0
iifname "vmnet8" jump input_vmnet8
iifname "tun0" jump input_tun0
}
chain forward {
type filter hook forward priority 0; policy drop;
counter
}
chain output {
type filter hook output priority 0; policy drop;
counter
oif { lo, tun0 } accept
oif { enp3s0f1, wlp2s0 } ip daddr 192.168.0.0/24 accept
oif { vmnet8 } accept
}
chain input_enp3s0f1 {
counter
}
chain input_wlp2s0 {
counter
}
chain input_vmnet8 {
counter
iifname "vmnet8" accept
}
chain input_tun0 {
counter
}
}