FM / examples

/usr/share/doc/nftables/examples

Name	Size	Mode	Actions
sysvinit/	-	0755	rm
all-in-one.nft	1016	0644	edit dl rm
arp-filter.nft	129	0644	edit dl rm
bridge-filter.nft	197	0644	edit dl rm
ct_helpers.nft	1263	0755	edit dl rm
inet-filter.nft	187	0644	edit dl rm
inet-nat.nft	251	0644	edit dl rm
ipv4-filter.nft	182	0644	edit dl rm
ipv4-mangle.nft	74	0644	edit dl rm
ipv4-nat.nft	246	0644	edit dl rm
ipv4-raw.nft	137	0644	edit dl rm
ipv6-filter.nft	186	0644	edit dl rm
ipv6-mangle.nft	78	0644	edit dl rm
ipv6-nat.nft	253	0644	edit dl rm
ipv6-raw.nft	141	0644	edit dl rm
load_balancing.nft	1858	0755	edit dl rm
nat.nft	1165	0755	edit dl rm
netdev-ingress.nft	128	0644	edit dl rm
overview.nft	1077	0755	edit dl rm
pf.os	28884	0644	edit dl rm
README	475	0644	edit dl rm
secmark.nft	2404	0755	edit dl rm
sets_and_maps.nft	1278	0755	edit dl rm
workstation.nft	817	0755	edit dl rm

Edit: /usr/share/doc/nftables/examples/overview.nft (1077B)

#!/usr/sbin/nft -f

table inet overview_test_table {
	chain overview_test_chain {
		#
		# simple selectors
		#

# source & destination address
		ip saddr 1.1.1.1 ip daddr 2.2.2.2

# tcp or udp ports
		tcp dport 123
		udp sport 123

# using sets
		ip saddr {1.1.1.1, 2.2.2.2} ip daddr {3.3.3.3, 4.4.4.4} tcp dport {22, 80, 443}

# packets meta information: nic names
		iifname eth0 oifname eth1

# packets meta information: nic index
		iif bond0 oif bond1

# conntrack engine states
		ct state new,established
		ct state invalid
		ct state established,related

#
		# simple verdicts (iptables targets)
		#

# counter and drop all traffic
		counter drop

# accept all traffic
		accept

#
		# rejecting traffic (more info at http://wiki.nftables.org/)
		#

# counter and reject all traffic
		counter reject

# reject with a concrete ICMP code
		reject with icmp type host-unreachable

# reject with a concrete ICMPv6 code
		reject with icmpv6 type no-route

# multi-family reject, using the icmpx keyword
		reject with icmpx type admin-prohibited
	}
}

#!/usr/sbin/nft -f table inet overview_test_table { chain overview_test_chain { # # simple selectors # # source & destination address ip saddr 1.1.1.1 ip daddr 2.2.2.2 # tcp or udp ports tcp dport 123 udp sport 123 # using sets ip saddr {1.1.1.1, 2.2.2.2} ip daddr {3.3.3.3, 4.4.4.4} tcp dport {22, 80, 443} # packets meta information: nic names iifname eth0 oifname eth1 # packets meta information: nic index iif bond0 oif bond1 # conntrack engine states ct state new,established ct state invalid ct state established,related # # simple verdicts (iptables targets) # # counter and drop all traffic counter drop # accept all traffic accept # # rejecting traffic (more info at http://wiki.nftables.org/) # # counter and reject all traffic counter reject # reject with a concrete ICMP code reject with icmp type host-unreachable # reject with a concrete ICMPv6 code reject with icmpv6 type no-route # multi-family reject, using the icmpx keyword reject with icmpx type admin-prohibited } }