SNAT masquerade for outbound NAT

Source-NAT egress to the iface IP; needs a nat-type postrouting chain to exist

nft add rule ip nat postrouting oifname \"eth0\" masquerade
tool
nftables12 commands
tags
nftablesnetworkcloudfirewall

More nftables commands

  • DNAT port forward to internal host
    nft add rule ip nat prerouting iif \"eth0\" tcp dport 443 dnat to 10.0.0.5:8443

    Destination-NAT inbound to a backend; pair with a forward-chain accept rule

  • Rate-limit new connections
    nft add rule inet filter input tcp dport 22 ct state new limit rate 10/minute accept

    Throttle SSH brute-force; over-limit packets fall through to the chain policy

  • Watch ruleset changes live
    nft monitor ruleset

    Streams add/delete events as they happen; great for debugging dynamic rules

  • Atomic backup and restore of ruleset
    nft list ruleset > /etc/nftables.conf && nft -f /etc/nftables.conf

    nft -f applies the whole file atomically; partial failure rolls back, no half state

  • Hardware flowtable offload
    nft add flowtable inet filter ft '{ hook ingress priority 0 ; devices = { eth0, eth1 } ; }' && nft add rule inet filter forward ct state established flow add @ft

    Offloads established flows to fast path; add 'flags offload' for NIC hardware offload

all 12 nftables commands