nft

nftables keeps rules in tables of a family (ip, ip6, inet, arp, bridge), chains hooked into the kernel's path, and named sets and counters that rules use and that you can read on their own. A set holds elements (addresses, ports, or concatenations like port . IP . MAC), may have a size limit and a timeout per element, and rules can add to it as packets pass (add @set { ether saddr }): the way to keep state such as learned addresses. The bridge family filters frames crossing a Linux bridge, so a switch's port security, DHCP snooping and ARP inspection are nftables rules there.

nft command usage

nft list ruleset
nft list table FAMILY TABLE
nft list set FAMILY TABLE SET
nft list counter FAMILY TABLE COUNTER
nft add|delete element FAMILY TABLE SET '{ ELEMENT }'
nft flush set FAMILY TABLE SET

Options

list ruleset

print every table, chain, set and rule

list set bridge T S

print one named set and its elements

list counter bridge T C

print one named counter: packets and bytes

reset counter bridge T C

print a counter and zero it

add element … '{ E }'

put an element in a set by hand (a static entry)

flush set …

empty a set

-a

show each rule's handle, to delete it

nft examples

nft list set bridge netlab-security dhcp-bindings

Shows the switch's DHCP snooping bindings: port, IP and MAC of each lease, with the time left.

nft list counter bridge netlab-security arp-inspection

Shows how many ARP frames ARP inspection has dropped.

nft list set bridge netlab-security port-security-victim

Shows the secure MAC addresses port victim has learned.

nft flush set bridge netlab-security port-security-victim

Forgets the port's secure addresses, as Cisco's clear port-security.

nft list ruleset

Prints every table, chain and rule: the whole firewall.

nft -a list ruleset

Prints the ruleset with each rule's handle, the number you delete it by.

nft add table inet filter

Makes a table for IPv4 and IPv6 together (the inet family).

nft add chain inet filter input '{ type filter hook input priority 0; policy drop; }'

Makes an input chain that sees packets for this device and drops whatever no rule accepts.

nft add rule inet filter input ct state established,related accept

Lets replies to allowed connections back in: the stateful rule.

nft add rule inet filter input iif lo accept

Allows the device to talk to itself.

nft add rule inet filter input tcp dport '{ 22, 80, 443 }' accept

Allows three ports in one rule, with an anonymous set.

nft add rule inet filter input ip saddr 10.0.9.0/24 tcp dport 22 accept

Allows SSH only from the management network.

nft add rule ip nat postrouting oif eth1 masquerade

Hides the inside behind eth1's address, in a nat table's postrouting chain.

nft delete rule inet filter input handle 7

Deletes the rule with handle 7, as nft -a showed it.

Pitfalls

• Names include the family: nft list table netlab-security looks in family ip and finds nothing; say bridge.
• A set's elements with a timeout disappear by themselves: an empty binding table can just mean the leases expired.
• iptables and nftables rules both apply; on many systems iptables itself is a front end writing nftables rules.

Run it on real machines