Named set as IP blocklist nftables
Reusable named set; flags interval lets you store CIDR ranges, not just hosts
nft add set inet filter blocklist '{ type ipv4_addr ; flags interval ; }' && nft add element inet filter blocklist '{ 10.0.0.0/8, 192.0.2.5 }'
more nftables
all 12 commands →
Verdict map for port dispatch
nft add rule inet filter input tcp dport vmap '{ 22 : accept, 80 : accept, 443 : accept, 3306 : drop }'
List ruleset with rule handles
nft -a list ruleset
Delete a single rule by handle
nft delete rule inet filter input handle 7
Named counter on a rule
nft add rule inet filter input tcp dport 22 counter accept comment \"ssh\"
SNAT masquerade for outbound NAT
nft add rule ip nat postrouting oifname \"eth0\" masquerade