SNAT masquerade for outbound NAT nftables
Source-NAT egress to the iface IP; needs a nat-type postrouting chain to exist
nft add rule ip nat postrouting oifname \"eth0\" masquerade
more nftables
all 12 commands →
DNAT port forward to internal host
nft add rule ip nat prerouting iif \"eth0\" tcp dport 443 dnat to 10.0.0.5:8443
Rate-limit new connections
nft add rule inet filter input tcp dport 22 ct state new limit rate 10/minute accept
Watch ruleset changes live
nft monitor ruleset
Atomic backup and restore of ruleset
nft list ruleset > /etc/nftables.conf && nft -f /etc/nftables.conf
Hardware flowtable offload
nft add flowtable inet filter ft '{ hook ingress priority 0 ; devices = { eth0, eth1 } ; }' && nft add rule inet filter forward ct state established flow add @ft