nftables

Create input chain with drop policy Base-chain default-deny; note: add accept rules first or you lock yourself out nft add chain inet filter input '{ type filter hook input priority 0 ; policy drop ; }' #nftables#security#network#firewall Named set as IP blocklist Reusable named set; flags interval lets you store CIDR ranges, not just hosts nft add set inet filter blocklist '{ type ipv4_addr ; flags interval ; }' && nft add element inet filter blocklist '{ 10.0.0.0/8, 192.0.2.5 }' #nftables#security#network#firewall Verdict map for port dispatch vmap maps keys to verdicts in O(1); replaces a chain of dport == rules nft add rule inet filter input tcp dport vmap '{ 22 : accept, 80 : accept, 443 : accept, 3306 : drop }' #nftables#network#performance#firewall List ruleset with rule handles -a prints '# handle N' per rule; you need the handle to delete a single rule nft -a list ruleset #nftables#troubleshooting#network Delete a single rule by handle Surgical removal without flushing; get the handle from nft -a list ruleset nft delete rule inet filter input handle 7 #nftables#network#troubleshooting Named counter on a rule Inline counter tracks packets/bytes; reset with nft reset counters inet filter nft add rule inet filter input tcp dport 22 counter accept comment \"ssh\" #nftables#monitoring#observability#network SNAT masquerade for outbound NAT Source-NAT egress to the iface IP; needs a nat-type postrouting chain to exist nft add rule ip nat postrouting oifname \"eth0\" masquerade #nftables#network#cloud#firewall DNAT port forward to internal host Destination-NAT inbound to a backend; pair with a forward-chain accept rule nft add rule ip nat prerouting iif \"eth0\" tcp dport 443 dnat to 10.0.0.5:8443 #nftables#network#cloud#firewall Rate-limit new connections Throttle SSH brute-force; over-limit packets fall through to the chain policy nft add rule inet filter input tcp dport 22 ct state new limit rate 10/minute accept #nftables#security#performance#network Watch ruleset changes live Streams add/delete events as they happen; great for debugging dynamic rules nft monitor ruleset #nftables#debug#monitoring#troubleshooting Atomic backup and restore of ruleset nft -f applies the whole file atomically; partial failure rolls back, no half state nft list ruleset > /etc/nftables.conf && nft -f /etc/nftables.conf #nftables#gitops#network#firewall Hardware flowtable offload Offloads established flows to fast path; add 'flags offload' for NIC hardware offload nft add flowtable inet filter ft '{ hook ingress priority 0 ; devices = { eth0, eth1 } ; }' && nft add rule inet filter forward ct state established flow add @ft #nftables#performance#network#kernel