Skip to content

v0.1.2 — complete nftables firewall monitoring

Latest
Latest

Choose a tag to compare

View all tags
@farchanjo farchanjo released this 30 May 01:42
v0.1.2
b9bec8e

nft_exporter v0.1.2

Complete nftables firewall monitoring over NFNETLINK (ADR-0030) — direct native-API forensics for the firewall.

Added — 14 nftables metrics

  • nft_rule_counter_{bytes,packets}_total{table,chain,comment} — per-rule hit counters keyed by rule comment (the "which rule matched/dropped" forensic), parsed from NFTA_RULE_EXPRESSIONS + NFTA_RULE_USERDATA. Anonymous rules suppressed; hard cap of 1000 emitted series (overflow surfaces on nft_scrape_collector_error_total{reason="cardinality_overflow"}).
  • nft_chain_info{table,chain,type,hook,priority,policy}, nft_table_info, nft_set_elements{table,name,type}.
  • nft_named_counter/quota/limit_* (named-object stats incl. quota/limit exhaustion), nft_ruleset_generation (change detection), nft_flowtable_info.

Fixed

  • nftables.family_label: corrected NFPROTO_* values (3=arp, 5=netdev, 7=bridge, 10=ip6) — were wrong for bridge/arp families.
  • nftables scrape no longer hangs: each dump now uses a fresh netlink socket (sequential dumps on a shared socket stalled), and GETGEN is a single request_single (not an NLM_F_DUMP that blocks on a never-sent NLMSG_DONE).

Known issues

  • nftables set key-type label falls back to other for some key types (the element count is correct).

Install (Debian/Ubuntu, x86_64 glibc)

curl -sSLO https://github.com/farchanjo/netlink_exporter/releases/download/v0.1.2/netlink-exporter_0.1.2_amd64.deb
sudo apt install ./netlink-exporter_0.1.2_amd64.deb   # systemd service on :33400, drop_monitor enabled

Or the raw glibc binary: netlink_exporter-v0.1.2-x86_64-unknown-linux-gnu.tar.gz.

Built with Rust 1.96.0, edition 2024, optimized release (lto=fat, codegen-units=1, strip). SHA256SUMS attached.

Assets 5
Loading