Verdict map for port dispatch nftables
vmap maps keys to verdicts in O(1); replaces a chain of dport == rules
nft add rule inet filter input tcp dport vmap '{ 22 : accept, 80 : accept, 443 : accept, 3306 : drop }'
more nftables
all 12 commands →
List ruleset with rule handles
nft -a list ruleset
Delete a single rule by handle
nft delete rule inet filter input handle 7
Named counter on a rule
nft add rule inet filter input tcp dport 22 counter accept comment \"ssh\"
SNAT masquerade for outbound NAT
nft add rule ip nat postrouting oifname \"eth0\" masquerade
DNAT port forward to internal host
nft add rule ip nat prerouting iif \"eth0\" tcp dport 443 dnat to 10.0.0.5:8443