tftp with nftables

To use tftp behind nftables with any kind of drop all rule specified add the following to /etc/nftables.conf

1
2
3
4
5
6
7

ct helper tftp {
    type "tftp" protocol udp
}

chain input {
    udp dport 69 ct helper set "tftp"
}

And (kernel < 6.0.0) enable conntrack helpers with

1

$ echo 1 | sudo tee /proc/sys/net/netfilter/nf_conntrack_helper

tftp-hpa uses fcntl() to lock files. This might cause issues when serving files on a NFS mount. In case this happens mounting the NFS with the nolock option might be a solution.