Named counter on a rule

Inline counter tracks packets/bytes; reset with nft reset counters inet filter

nft add rule inet filter input tcp dport 22 counter accept comment \"ssh\"
tool
nftables12 commands
tags
nftablesmonitoringobservabilitynetwork

More nftables commands

  • SNAT masquerade for outbound NAT
    nft add rule ip nat postrouting oifname \"eth0\" masquerade

    Source-NAT egress to the iface IP; needs a nat-type postrouting chain to exist

  • DNAT port forward to internal host
    nft add rule ip nat prerouting iif \"eth0\" tcp dport 443 dnat to 10.0.0.5:8443

    Destination-NAT inbound to a backend; pair with a forward-chain accept rule

  • Rate-limit new connections
    nft add rule inet filter input tcp dport 22 ct state new limit rate 10/minute accept

    Throttle SSH brute-force; over-limit packets fall through to the chain policy

  • Watch ruleset changes live
    nft monitor ruleset

    Streams add/delete events as they happen; great for debugging dynamic rules

  • Atomic backup and restore of ruleset
    nft list ruleset > /etc/nftables.conf && nft -f /etc/nftables.conf

    nft -f applies the whole file atomically; partial failure rolls back, no half state

all 12 nftables commands