Rewrite nftables variables based on nftables' logic.

Add an example for redirecting.

config/action.d/nftables-allports.conf

@@ -13,10 +13,10 @@ before = nftables-common.conf
 
 [Definition]
 
-# Option:  nftables_mode
+# Option:  match
-# Notes.:  additional expressions for nftables filter rule
+# Notes.:  additional matches for nftables filter rule
-# Values:  nftables expressions
+# Values:  nftables matches
 #
-nftables_mode = meta l4proto <protocol>
+match = meta l4proto <protocol>
 
 [Init]

config/action.d/nftables-common.conf

@@ -11,6 +11,14 @@
 # used in all nftables based actions by default.
 #
 # The user can override the defaults in nftables-common.local
+# Example: redirect flow to honeypot
+#
+# [Init]
+# table_family = ip
+# chain_type = nat
+# chain_hook = prerouting
+# chain_priority = -50
+# blocktype = counter redirect to 2222
 
 [INCLUDES]
 
@@ -18,35 +26,38 @@ after = nftables-common.local
 
 [Definition]
 
-# Option:  nftables_mode
+# Option:  match
-# Notes.:  additional expressions for nftables filter rule
+# Notes.:  additional matches for nftables filter rule.
-# Values:  nftables expressions
+#          leaving it empty will block all. (include udp and icmp)
+# Values:  nftables matches
 #
-nftables_mode = <protocol> dport \{ <port> \}
+match = <protocol> dport \{ <port> \}
 
 # Option:  actionstart
 # Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
 # Values:  CMD
 #
-actionstart = <nftables> add set <nftables_family> <nftables_table> <set_name> \{ type <nftables_type>\; \}
+actionstart = <nftables> add table <table_family> f2b-table
-              <nftables> insert rule <nftables_family> <nftables_table> <chain> %(nftables_mode)s <address_family> saddr @<set_name> <blocktype>
+              <nftables> -- add chain <table_family> f2b-table f2b-chain \{ type <chain_type> hook <chain_hook> priority <chain_priority> \; \}
+              <nftables> add set <table_family> f2b-table <addr_set> \{ type <addr_type>\; \}
+              <nftables> add rule <table_family> f2b-table f2b-chain %(match)s <addr_family> saddr @<addr_set> <blocktype>
 
-_nft_list = <nftables> --handle --numeric list chain <nftables_family> <nftables_table> <chain>
+_nft_list = <nftables> -a list chain <table_family> f2b-table f2b-chain
-_nft_get_handle_id = grep -m1 '<address_family> saddr @<set_name> <blocktype> # handle' | grep -oe ' handle [0-9]*'
+_nft_get_handle_id = grep -m1 '@<addr_set> ' | grep -oe ' handle [0-9]*'
 
 # Option:  actionstop
 # Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
 # Values:  CMD
 #
 actionstop = HANDLE_ID=$(%(_nft_list)s | %(_nft_get_handle_id)s)
-             <nftables> delete rule <nftables_family> <nftables_table> <chain> $HANDLE_ID
+             <nftables> delete rule <table_family> f2b-table f2b-chain $HANDLE_ID
-             <nftables> delete set <nftables_family> <nftables_table> <set_name>
+             <nftables> delete set <table_family> f2b-table <addr_set>
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
-actioncheck = <nftables> list chain <nftables_family> <nftables_table> <chain> | grep -q '@<set_name>[ \t]'
+actioncheck = <nftables> list chain <table_family> f2b-table f2b-chain | grep -q '@<addr_set>[ \t]'
 
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -54,7 +65,7 @@ actioncheck = <nftables> list chain <nftables_family> <nftables_table> <chain> |
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = <nftables> add element <nftables_family> <nftables_table> <set_name> \{ <ip> \}
+actionban = <nftables> add element <table_family> f2b-table <addr_set> <ip>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -62,33 +73,38 @@ actionban = <nftables> add element <nftables_family> <nftables_table> <set_name>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = <nftables> delete element <nftables_family> <nftables_table> <set_name> \{ <ip> \}
+actionunban = <nftables> delete element <table_family> f2b-table <addr_set> <ip>
 
 [Init]
 
-# Option:  nftables_type
+# Option:  table_family
-# Notes.:  address type to work with
-# Values:  [ipv4_addr | ipv6_addr]  Default: ipv4_addr
-#
-nftables_type = ipv4_addr
-
-# Option:  nftables_family
 # Notes.:  address family to work in
 # Values:  [ip | ip6 | inet]  Default: inet
+table_family = inet
+
+# Option:  chain_type
+# Notes.:  refers to the kind of chain to be created
+# Values:  [filter | route | nat]  Default: filter
 #
-nftables_family = inet
+chain_type = filter
 
-# Option:  nftables_table
+# Option:  chain_hook
-# Notes.:  table in the address family to work in
+# Notes.:  refers to the kind of chain to be created
-# Values:  STRING  Default: filter
+# Values:  [ prerouting | input | forward | output | postrouting ]  Default: input
 #
-nftables_table = filter
+chain_hook = input
 
-# Option:  chain
+# Option:  chain_priority
-# Notes    specifies the nftables chain to which the Fail2Ban rules should be
+# Notes.:  priority in the chain.
-#          added
+# Values:  NUMBER  Default: -1
-# Values:  STRING  Default: input
+#
-chain = input
+chain_priority = -1
+
+# Option:  addr_type
+# Notes.:  address type to work with
+# Values:  [ipv4_addr | ipv6_addr]  Default: ipv4_addr
+#
+addr_type = ipv4_addr
 
 # Default name of the filtering set
 #
@@ -108,8 +124,8 @@ protocol = tcp
 
 # Option:  blocktype
 # Note:    This is what the action does with rules. This can be any jump target
-#          as per the nftables man page (section 8). Common values are drop
+#          as per the nftables man page (section 8). Common values are drop,
-#          reject, reject with icmp type host-unreachable
+#          reject, reject with icmpx type host-unreachable, redirect to 2222
 # Values:  STRING
 blocktype = reject
 
@@ -118,18 +134,17 @@ blocktype = reject
 # Values:  STRING
 nftables = nft
 
-# Option: set_name
+# Option: addr_set
 # Notes.: The name of the nft set used to store banned addresses
 # Values: STRING
-set_name = f2b-<name>
+addr_set = addr-set-<name>
 
-# Option: address_family
+# Option: addr_family
 # Notes.: The family of the banned addresses
 # Values: [ ip | ip6 ]
-address_family = ip
+addr_family = ip
 
 [Init?family=inet6]
-
+addr_family = ip6
-nftables_type = ipv6_addr
+addr_type = ipv6_addr
-set_name = f2b-<name>6
+addr_set = addr6-set-<name>
-address_family = ip6

config/action.d/nftables-multiport.conf

@@ -13,10 +13,10 @@ before = nftables-common.conf
 
 [Definition]
 
-# Option:  nftables_mode
+# Option:  match
-# Notes.:  additional expressions for nftables filter rule
+# Notes.:  additional matches for nftables filter rule
-# Values:  nftables expressions
+# Values:  nftables matches
 #
-nftables_mode = <protocol> dport \{ <port> \}
+match = <protocol> dport \{ <port> \}
 
 [Init]