Named counter on a rule nftables
Inline counter tracks packets/bytes; reset with nft reset counters inet filter
nft add rule inet filter input tcp dport 22 counter accept comment \"ssh\"
more nftables
all 12 commands →
SNAT masquerade for outbound NAT
nft add rule ip nat postrouting oifname \"eth0\" masquerade
DNAT port forward to internal host
nft add rule ip nat prerouting iif \"eth0\" tcp dport 443 dnat to 10.0.0.5:8443
Rate-limit new connections
nft add rule inet filter input tcp dport 22 ct state new limit rate 10/minute accept
Watch ruleset changes live
nft monitor ruleset
Atomic backup and restore of ruleset
nft list ruleset > /etc/nftables.conf && nft -f /etc/nftables.conf