Atomic backup and restore of ruleset nftables
nft -f applies the whole file atomically; partial failure rolls back, no half state
nft list ruleset > /etc/nftables.conf && nft -f /etc/nftables.conf
more nftables
all 12 commands →
Hardware flowtable offload
nft add flowtable inet filter ft '{ hook ingress priority 0 ; devices = { eth0, eth1 } ; }' && nft add rule inet filter forward ct state established flow add @ft
Create input chain with drop policy
nft add chain inet filter input '{ type filter hook input priority 0 ; policy drop ; }'
Named set as IP blocklist
nft add set inet filter blocklist '{ type ipv4_addr ; flags interval ; }' && nft add element inet filter blocklist '{ 10.0.0.0/8, 192.0.2.5 }'
Verdict map for port dispatch
nft add rule inet filter input tcp dport vmap '{ 22 : accept, 80 : accept, 443 : accept, 3306 : drop }'
List ruleset with rule handles
nft -a list ruleset