Prometheus Nftables Exporter

A Prometheus Exporter that exposes metrics from nftables.

Setup

Just start the docker container. It requires the net_admin capability and must be part of the host network namespace in order to collect data from nftables.

docker run -d -p 9639 --cap-drop all --cap-add net_admin --network host ghcr.io/dadevel/nftables-exporter

And test it.

curl http://localhost:9630/metrics

nftables-exporter can annotate ip addresses in nftables maps, meters and sets with a country code. You can use this for example with the Grafana Worldmap Panel. Unfortunately you have provide a (free) MaxMind license key. See here for more information.

docker run -d -p 9639 --cap-drop all --cap-add net_admin --network host -e MAXMIND_LICENSE_KEY=INSERT_YOUR_KEY_HERE ghcr.io/dadevel/nftables-exporter

Configure

Environment variable	Description
`NFTABLES_EXPORTER_ADDRESS`	listen address, listening on all network interfaces by default
`NFTABLES_EXPORTER_PORT`	listen port, defaults to `9639`
`NFTABLES_EXPORTER_UPDATE_PERIOD`	update interval in seconds, defaults to `60`
`NFTABLES_EXPORTER_LOG_LEVEL`	one of the log levels from pythons `logging` module, defaults to `info`
`MAXMIND_LICENSE_KEY`	license key for maxmind geoip database, optional
`MAXMIND_DATABASE_EDITION`	maxmind database edition, defaults to `GeoLite2-Country`
`MAXMIND_CACHE_DIRECTORY`	directory to store maxmind database in, defaults to `./data`

Example

Firewall ruleset:

table inet filter {
  counter http-allowed {
  }

  counter http-denied {
  }

  chain input {
    type filter hook input priority 0
    policy drop
    tcp dport { 80, 443 } meter http-limit { ip saddr limit rate over 16 mbytes/second } counter name http-denied drop
    tcp dport { 80, 443 } meter http6-limit { ip6 saddr limit rate over 16 mbytes/second } counter name http-denied drop
    tcp dport { 80, 443 } counter name http-allowed accept
  }
}

Resulting metrics:

nftables_counter_bytes_total{family="inet", name="http-allowed", table="filter"} 90576
nftables_counter_packets_total{family="inet", name="http-allowed", table="filter"} 783
nftables_counter_bytes_total{family="inet", name="http-denied", table="filter"} 936
nftables_counter_packets_total{family="inet", name="http-denied", table="filter"} 13
nftables_meter_elements{family="ip", name="http-limit", table="filter", type="ipv4_addr", country="US"} 7
nftables_meter_elements{family="ip", name="http-limit", table="filter", type="ipv4_addr", country="DE"} 3
nftables_meter_elements{family="ip", name="http-limit", table="filter", type="ipv4_addr", country=""} 2
nftables_meter_elements{family="ip6", name="http6-limit", table="filter", type="ipv6_addr", country="US"} 2

Notice: Since v2.0.0 nftables_counter_bytes and nftables_counter_packets are proper Prometheus counters and therefore got a _total suffix.

Build

Install the dependencies and run the python script.

pip3 install -r ./requirements.txt
python3 ./main.py

The Dockerfile is available under github.com/dadevel/dockerfiles.