watch -d nft -a list ruleset

nft flush ruleset

auf die harte Tour: alle aktuellen Regeln löschen und neu einlesen:

(echo 'flush ruleset'; nft -s list ruleset) | nft -f -

¹⁾

nft -ia
add table inet filter
add chain inet filter input { type filter hook input priority filter; policy accept; }
add chain inet filter forward { type filter hook forward priority filter; policy accept; }
add chain inet filter output { type filter hook output priority filter; policy accept; }

²⁾

add table ip nat
add chain ip nat prerouting { type nat hook prerouting priority dstnat; }
add chain ip nat postrouting { type nat hook postrouting priority srcnat; } 

Erste Zeile flush ruleset beachten, sonst werden die Regeln hinzugefügt.

nftables.conf

flush ruleset
table inet filter {
        chain input {
                type filter hook input priority 0; policy accept;
        }
        chain forward {
                type filter hook forward priority 0; policy accept;
        }
        chain output {
                type filter hook output priority 0; policy accept;
        }
}
table ip nat {
        chain prerouting {
                type nat hook prerouting priority -100; policy accept;
        }
        chain postrouting {
                type nat hook postrouting priority 100; policy accept;
        }
}

nft -f nftables.conf

accept, drop oder reject jeweils counter voran stellen: counter accept, counter drop oder counter reject und Regeln wie oben beschrieben mit watch -d nft -a list ruleset beobachten.

Trace-Regel hinzufügen:

nft insert rule inet filter input iifname eth0 nftrace set 1

Pakete anzeigen:

nft monitor trace

nft -s flush ruleset > /etc/nftables.conf

nft -f /etc/nftables.conf

³⁾

• https://wiki.nftables.org/wiki-nftables/index.php/Quick_reference-nftables_in_10_minutes
• Allow ICMPv6 traffic (https://tools.ietf.org/html/rfc4890#page-18)
• https://commons.wikimedia.org/wiki/File:Netfilter-packet-flow.svg