FM / examples

/usr/share/doc/nftables/examples

Name	Size	Mode	Actions
sysvinit/	-	0755	rm
all-in-one.nft	1016	0644	edit dl rm
arp-filter.nft	129	0644	edit dl rm
bridge-filter.nft	197	0644	edit dl rm
ct_helpers.nft	1263	0755	edit dl rm
inet-filter.nft	187	0644	edit dl rm
inet-nat.nft	251	0644	edit dl rm
ipv4-filter.nft	182	0644	edit dl rm
ipv4-mangle.nft	74	0644	edit dl rm
ipv4-nat.nft	246	0644	edit dl rm
ipv4-raw.nft	137	0644	edit dl rm
ipv6-filter.nft	186	0644	edit dl rm
ipv6-mangle.nft	78	0644	edit dl rm
ipv6-nat.nft	253	0644	edit dl rm
ipv6-raw.nft	141	0644	edit dl rm
load_balancing.nft	1858	0755	edit dl rm
nat.nft	1165	0755	edit dl rm
netdev-ingress.nft	128	0644	edit dl rm
overview.nft	1077	0755	edit dl rm
pf.os	28884	0644	edit dl rm
README	475	0644	edit dl rm
secmark.nft	2404	0755	edit dl rm
sets_and_maps.nft	1278	0755	edit dl rm
workstation.nft	817	0755	edit dl rm

Edit: /usr/share/doc/nftables/examples/sets_and_maps.nft (1278B)

#!/usr/sbin/nft -f

# This example file shows how to use sets and maps in the nftables framework.
# This script is meant to be loaded with `nft -f <file>`
# For up-to-date information please visit https://wiki.nftables.org

# symbolic anonymous set definition built from symbolic singleton definitions
define int_if1	 = eth0
define int_if2	 = eth1
define int_ifs	 = { $int_if1, $int_if2 }

define ext_if1	 = eth2
define ext_if2	 = eth3
define ext_ifs	 = { $ext_if1, $ext_if2 }

# recursive symbolic anonymous set definition
define local_ifs = { $int_ifs, $ext_ifs }

# symbolic anonymous set definition
define tcp_ports = { ssh, domain, https, 123-125 }

delete table filter
table filter {
	# named set of type iface_index
	set local_ifs {
		type iface_index
	}

# named map of type iface_index : ipv4_addr
	map nat_map {
		type iface_index : ipv4_addr
	}

map jump_map {
		type iface_index : verdict
	}

chain input_1 { counter; }
	chain input_2 { counter; }
	chain input {
		type filter hook input priority 0

# symbolic anonymous sets
		meta iif $local_ifs tcp dport $tcp_ports counter

# literal anonymous set
		meta iif { eth0, eth1 } counter

meta iif @local_ifs counter
		meta iif vmap @jump_map

#meta iif vmap { eth0 : jump input1, eth1 : jump input2 }
	}
}

#!/usr/sbin/nft -f # This example file shows how to use sets and maps in the nftables framework. # This script is meant to be loaded with `nft -f ` # For up-to-date information please visit https://wiki.nftables.org # symbolic anonymous set definition built from symbolic singleton definitions define int_if1 = eth0 define int_if2 = eth1 define int_ifs = { $int_if1, $int_if2 } define ext_if1 = eth2 define ext_if2 = eth3 define ext_ifs = { $ext_if1, $ext_if2 } # recursive symbolic anonymous set definition define local_ifs = { $int_ifs, $ext_ifs } # symbolic anonymous set definition define tcp_ports = { ssh, domain, https, 123-125 } delete table filter table filter { # named set of type iface_index set local_ifs { type iface_index } # named map of type iface_index : ipv4_addr map nat_map { type iface_index : ipv4_addr } map jump_map { type iface_index : verdict } chain input_1 { counter; } chain input_2 { counter; } chain input { type filter hook input priority 0 # symbolic anonymous sets meta iif $local_ifs tcp dport $tcp_ports counter # literal anonymous set meta iif { eth0, eth1 } counter meta iif @local_ifs counter meta iif vmap @jump_map #meta iif vmap { eth0 : jump input1, eth1 : jump input2 } } }