Named set as IP blocklist

Reusable named set; flags interval lets you store CIDR ranges, not just hosts

nft add set inet filter blocklist '{ type ipv4_addr ; flags interval ; }' && nft add element inet filter blocklist '{ 10.0.0.0/8, 192.0.2.5 }'
tool
nftables12 commands
tags
nftablessecuritynetworkfirewall

More nftables commands

  • Verdict map for port dispatch
    nft add rule inet filter input tcp dport vmap '{ 22 : accept, 80 : accept, 443 : accept, 3306 : drop }'

    vmap maps keys to verdicts in O(1); replaces a chain of dport == rules

  • List ruleset with rule handles
    nft -a list ruleset

    -a prints '# handle N' per rule; you need the handle to delete a single rule

  • Delete a single rule by handle
    nft delete rule inet filter input handle 7

    Surgical removal without flushing; get the handle from nft -a list ruleset

  • Named counter on a rule
    nft add rule inet filter input tcp dport 22 counter accept comment \"ssh\"

    Inline counter tracks packets/bytes; reset with nft reset counters inet filter

  • SNAT masquerade for outbound NAT
    nft add rule ip nat postrouting oifname \"eth0\" masquerade

    Source-NAT egress to the iface IP; needs a nat-type postrouting chain to exist

all 12 nftables commands