Quick reference-nftables in 10 minutes - nftables wiki

tcp dport 22 add @ssh_flood { ip saddr ct count over 2 } reject
[ which requires an existing ssh_flood set, ie. add set filter ssh_flood { type ipv4_addr; flags dynamic; } ]
Meta
meta
matches packet by metainformation.
meta match
iifname
Input interface name
meta iifname "eth0"
meta iifname != "eth0"
meta iifname { "eth0", "lo" }
meta iifname "eth*"
oifname

Output interface name
meta oifname "eth0"
meta oifname != "eth0"
meta oifname { "eth0", "lo" }
meta oifname "eth*"
iif
Input interface index
meta iif eth0
meta iif != eth0
oif

Output interface index
meta oif lo
meta oif != lo
meta oif { eth0, lo }
iiftype
Input interface type
meta iiftype { ether, ppp, ipip, ipip6, loopback, sit, ipgre }
meta iiftype != ether
meta iiftype ether
oiftype

Output interface hardware type
meta oiftype { ether, ppp, ipip, ipip6, loopback, sit, ipgre }
meta oiftype != ether
meta oiftype ether
length
Length of the packet in bytes
meta length 1000
meta length != 1000
meta length > 1000
meta length 33-45
meta length != 33-45
meta length { 33, 55, 67, 88 }
meta length { 33-55, 67-88 }
protocol
ethertype protocol
meta protocol ip
meta protocol != ip
meta protocol { ip, arp, ip6, vlan }
nfproto
meta nfproto ipv4
meta nfproto != ipv6
meta nfproto { ipv4, ipv6 }
l4proto
meta l4proto 22
meta l4proto != 233
meta l4proto 33-45
meta l4proto { 33, 55, 67, 88 }
meta l4proto { 33-55 }
mark [set]
Packet mark
meta mark 0x4
meta mark 0x00000032
meta mark and 0x03 == 0x01
meta mark and 0x03 != 0x01
meta mark != 0x10
meta mark or 0x03 == 0x01
meta mark or 0x03 != 0x01
meta mark xor 0x03 == 0x01
meta mark xor 0x03 != 0x01
meta mark set 0xffffffc8 xor 0x16
meta mark set 0x16 and 0x16
meta mark set 0xffffffe9 or 0x16
meta mark set 0xffffffde and 0x16
meta mark set 0x32 or 0xfffff
meta mark set 0xfffe xor 0x16
priority [set]
tc class id
meta priority none
meta priority 0x1:0x1
meta priority 0x1:0xffff
meta priority 0xffff:0xffff
meta priority set 0x1:0x1
meta priority set 0x1:0xffff
meta priority set 0xffff:0xffff
skuid
UID associated with originating socket
meta skuid { bin, root, daemon }
meta skuid root
meta skuid != root
meta skuid lt 3000
meta skuid gt 3000
meta skuid eq 3000
meta skuid 3001-3005
meta skuid != 2001-2005
meta skuid { 2001-2005 }
skgid
GID associated with originating socket
meta skgid { bin, root, daemon }
meta skgid root
meta skgid != root
meta skgid lt 3000
meta skgid gt 3000
meta skgid eq 3000
meta skgid 3001-3005
meta skgid != 2001-2005
meta skgid { 2001-2005 }
rtclassid
Routing realm
meta rtclassid cosmos
pkttype
Packet type
meta pkttype broadcast
meta pkttype != broadcast
meta pkttype { broadcast, unicast, multicast }
cpu
CPU ID
meta cpu 1
meta cpu != 1
meta cpu 1-3
meta cpu != 1-2
meta cpu { 2,3 }
meta cpu { 2-3, 5-7 }
iifgroup
Input interface group
meta iifgroup 0
meta iifgroup != 0
meta iifgroup default
meta iifgroup != default
meta iifgroup { default }
meta iifgroup { 11,33 }
meta iifgroup { 11-33 }
oifgroup
Output interface group
meta oifgroup 0
meta oifgroup != 0
meta oifgroup default
meta oifgroup != default
meta oifgroup { default }
meta oifgroup { 11,33 }
meta oifgroup { 11-33 }
cgroup
meta cgroup 1048577
meta cgroup != 1048577
meta cgroup { 1048577, 1048578 }
meta cgroup 1048577-1048578
meta cgroup != 1048577-1048578
meta cgroup { 1048577-1048578 }
Statements
statement
is the action performed when the packet match the rule. It could be
terminal
and
non-terminal
. In a certain rule we can consider several non-terminal statements but only a single terminal statement.
Verdict statements
The
verdict statement
alters control flow in the ruleset and issues policy decisions for packets. The valid verdict statements are:
accept
: Accept the packet and stop the remain rules evaluation.
drop
: Drop the packet and stop the remain rules evaluation.
queue
: Queue the packet to userspace and stop the remain rules evaluation.
continue
: Continue the ruleset evaluation with the next rule.
return
: Return from the current chain and continue at the next rule of the last chain. In a base chain it is equivalent to accept
jump
: Continue at the first rule of . It will continue at the next rule after a return statement is issued
goto
: Similar to jump, but after the new chain the evaluation will continue at the last chain instead of the one containing the goto statement
Log
log statement
level [over] [burst ]
Log level
log
log level emerg
log level alert
log level crit
log level err
log level warn
log level notice
log level info
log level debug
group [queue-threshold ] [snaplen ] [prefix ""]
log prefix aaaaa-aaaaaa group 2 snaplen 33
log group 2 queue-threshold 2
log group 2 snaplen 33
Reject
The default
reject
will be the ICMP type
port-unreachable
. The
icmpx
is only used for inet family support.
More information on the
Rejecting_traffic
page.
reject statement
with type
reject
reject with icmp type host-unreachable
reject with icmp type net-unreachable
reject with icmp type prot-unreachable
reject with icmp type port-unreachable
reject with icmp type net-prohibited
reject with icmp type host-prohibited
reject with icmp type admin-prohibited
reject with icmpv6 type no-route
reject with icmpv6 type admin-prohibited
reject with icmpv6 type addr-unreachable
reject with icmpv6 type port-unreachable
reject with icmpx type host-unreachable
reject with icmpx type no-route
reject with icmpx type admin-prohibited
reject with icmpx type port-unreachable
ip protocol tcp reject with tcp reset
Counter
counter statement
packets bytes
counter
counter packets 0 bytes 0
Limit
limit statement
rate [over] [burst ]
Rate limit
limit rate 400/minute
limit rate 400/hour
limit rate over 40/day
limit rate over 400/week
limit rate over 1023/second burst 10 packets
limit rate 1025 kbytes/second
limit rate 1023000 mbytes/second
limit rate 1025 bytes/second burst 512 bytes
limit rate 1025 kbytes/second burst 1023 kbytes
limit rate 1025 mbytes/second burst 1025 kbytes
limit rate 1025000 mbytes/second burst 1023 mbytes
Nat
nat statement
dnat to
Destination address translation
dnat to 192.168.3.2
dnat to ct mark map { 0x00000014 : 1.2.3.4 }
snat to
Source address translation
snat to 192.168.3.2
snat to 2001:838:35f:1::-2001:838:35f:2:::100
masquerade [] [to :]
Masquerade
masquerade
masquerade persistent,fully-random,random
masquerade to :1024
masquerade to :1024-2048
Queue
queue statement
num
queue
queue num 2
queue num 2-3
queue num 4-5 fanout bypass
queue num 4-5 fanout
queue num 4-5 bypass
Extras
Export Configuration
% nft export (xml | json)
Monitor Events
Monitor events from Netlink creating filters.
% nft monitor [new | destroy] [tables | chains | sets | rules | elements] [xml | json]
Nft scripting
List ruleset
% nft list ruleset
Flush ruleset
% nft flush ruleset
Load ruleset
Create a command batch file and load it with the nft interpreter,
% echo "flush ruleset" > /etc/nftables.rules
% echo "add table filter" >> /etc/nftables.rules
% echo "add chain filter input" >> /etc/nftables.rules
% echo "add rule filter input meta iifname lo accept" >> /etc/nftables.rules
% nft -f /etc/nftables.rules
or create an executable nft script file,
% cat << EOF > /etc/nftables.rules
> #!/usr/local/sbin/nft -f
> flush ruleset
> add table filter
> add chain filter input
> add rule filter input meta iifname lo accept
> EOF
% chmod u+x /etc/nftables.rules
% /etc/nftables.rules
or create an executable nft script file from an already created ruleset,
% nft list ruleset > /etc/nftables.rules
% nft flush ruleset
% nft -f /etc/nftables.rules
Examples
Simple IP/IPv6 Firewall
flush ruleset

table firewall {
chain incoming {
type filter hook input priority 0; policy drop;

# established/related connections
ct state established,related accept

# loopback interface
iifname lo accept

# icmp
icmp type echo-request accept

# open tcp ports: sshd (22), httpd (80)
tcp dport { ssh, http } accept

table ip6 firewall {
chain incoming {
type filter hook input priority 0; policy drop;

# established/related connections
ct state established,related accept

# invalid connections
ct state invalid drop

# loopback interface
iifname lo accept

# icmp
# routers may also want: mld-listener-query, nd-router-solicit
icmpv6 type { echo-request, nd-neighbor-solicit } accept

# open tcp ports: sshd (22), httpd (80)
tcp dport { ssh, http } accept
Retrieved from "
Categories
Pages using deprecated source tags
Pages with too many expensive parser function calls
Navigation menu