watch -d nft -a list ruleset

¹⁾

nft flush ruleset

auf die harte Tour: alle aktuellen Regeln löschen und neu einlesen:

(echo 'flush ruleset'; nft -s list ruleset) | nft -f -

²⁾

nft -ia
add table inet filter
add chain inet filter input { type filter hook input priority filter; }
add chain inet filter forward { type filter hook forward priority filter; }
add chain inet filter output { type filter hook output priority filter; }

³⁾

add table ip nat
add chain ip nat prerouting { type nat hook prerouting priority dstnat; }
add chain ip nat postrouting { type nat hook postrouting priority srcnat; } 

Erste Zeile flush ruleset beachten, sonst werden die Regeln hinzugefügt.

nftables.conf

flush ruleset
table inet filter {
        chain input {
                type filter hook input priority filter;
        }
        chain forward {
                type filter hook forward priority filter;
        }
        chain output {
                type filter hook output priority filter;
        }
}
table inet nat {
        chain prerouting {
                type nat hook prerouting priority dstnat;
        }
        chain postrouting {
                type nat hook postrouting priority srcnat;
        }
}

nft -f nftables.conf

nft -ia
insert rule inet filter input tcp dport { 80, 3128 } drop

Alternativ, mit named sets:

nft -ia
add set inet filter port_blacklist { type inet_service; }
add element inet filter port_blacklist { 80, 3128 }
replace rule inet filter input handle 7 tcp dport @port_blacklist drop

accept, drop oder reject jeweils counter voran stellen: counter accept, counter drop oder counter reject und Regeln wie oben beschrieben mit watch -d nft -a list ruleset beobachten.

Beispiel:

nft -ia
replace rule inet filter input handle 7 tcp dport { 80, 3128 } counter reject with tcp reset

nft -ia
add rule inet filter input log prefix "input accept"

geloggte Pakete anzeigen:

dmesg -Tw

Trace-Regel hinzufügen:

nft insert rule inet filter input iifname eth0 nftrace set 1

Pakete anzeigen:

nft monitor trace

nft -s flush ruleset > /etc/nftables.conf

nft -f /etc/nftables.conf

⁴⁾

• https://wiki.nftables.org/wiki-nftables/index.php/Quick_reference-nftables_in_10_minutes
• Allow ICMPv6 traffic (https://tools.ietf.org/html/rfc4890#page-18)
• https://commons.wikimedia.org/wiki/File:Netfilter-packet-flow.svg