watch -d nft -a list ruleset

¹⁾

nft flush ruleset

nft -ia
add table inet filter
add chain inet filter input { type filter hook input priority filter; }
add chain inet filter forward { type filter hook forward priority filter; }
add chain inet filter output { type filter hook output priority filter; }

²⁾

add table inet nat
add chain inet nat prerouting { type nat hook prerouting priority dstnat; }
add chain inet nat postrouting { type nat hook postrouting priority srcnat; } 

nftables.conf

flush ruleset
table inet filter {
        chain input {
                type filter hook input priority filter;
        }
        chain forward {
                type filter hook forward priority filter;
        }
        chain output {
                type filter hook output priority filter;
        }
}
table inet nat {
        chain prerouting {
                type nat hook prerouting priority dstnat;
        }
        chain postrouting {
                type nat hook postrouting priority srcnat;
        }
}

nft -f nftables.conf

nft -ia
insert rule inet filter input tcp dport { 80, 3128 } drop

Alternativ, mit named sets:

nft -ia
add set inet filter port_blacklist { type inet_service; }
add element inet filter port_blacklist { 80, 3128 }
replace rule inet filter input handle 7 tcp dport @port_blacklist drop

nft -ia
delete rule inet filter input handle 7

accept, drop oder reject jeweils counter voran stellen: counter accept, counter drop oder counter reject

Beispiel:

nft -ia
replace rule inet filter input handle 7 tcp dport { 80, 3128 } counter reject with tcp reset

alle counter beobachten:

watch -d nft -a list ruleset

gezielter nur die counter einer Chain beobachten:

watch -d nft -a list chain inet filter input

auf die harte Tour: alle aktuellen Regeln löschen und neu einlesen:

(echo 'flush ruleset'; nft -s list ruleset) | nft -f -

nft -ia
add rule inet filter input log prefix "input accept"

geloggte Pakete anzeigen:

dmesg -Tw

Trace-Regel hinzufügen:

nft insert rule inet filter input iifname eth0 nftrace set 1

Pakete anzeigen:

nft monitor trace

nft -s list ruleset > /etc/nftables.conf

nft -f /etc/nftables.conf

³⁾

• https://wiki.nftables.org/wiki-nftables/index.php/Quick_reference-nftables_in_10_minutes
• Allow ICMPv6 traffic (https://tools.ietf.org/html/rfc4890#page-18)
• https://commons.wikimedia.org/wiki/File:Netfilter-packet-flow.svg