nftable, nft basic, nft commands

1
2
3

sudo pacman -S nftables
sudo systemctl start nftables
sudo systemctl enable nftables

1
2

systemctl disable --now firewalld

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

# 列出所有表
nft list tables

# 列出某一个族的表
# 列出 inet 族的表
nft list tables inet

# 列出 ip 族的表
nft list tables ip

# 列出 table0 表的内容
nft list table ip table0
nft list table table0 

# list table content with handle
nft -a list table filter

# 增加表, Adding tables

# 命令行
# nft add table [family] <name>
nft add table ip table0

# 族可以不写, 默认簇: ip
nft add table table0

# 删除 ip 族的 table0 表
nft delete table ip table0
# 默认 ip 族
nft delete table table0

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

# 查看 table 的内容, 能看到 Table 里的 链
nft list table table0 

# 创建链

# 创建一个常规链
# 将名为 chain0 的常规链添加到 ip 簇(默认) 中名为 table0 的表中
nft add chain table0 chain0

# 创建一个基本链
# nft add chain [<family>]  <chain-name> { type <type> hook <hook> priority <value> \; [policy <policy>] }
# 要和hook (钩子) 相关连
nft add chain table0 chain0 { type filter hook input priority 0 \; } 
nft add chain table0 chain0 { type filter hook output priority 0 \; } 

nft add chain ip table0 chain1 { type filter hook input priority 0\; }
nft add chain table0 chain1 { type filter hook input priority 0\; }
nft add chain table0 chain2 { type filter hook output priority 0\; }

# 将默认表中的 input 链策略从 accept 更改为 drop
nft chain ip table0 input { policy drop \; }

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

# 列出所有规则
nft list ruleset

# nft add rule [<family>] <table> <chain> <matches> <statements>

# 添加一条规则把源端口是 1025 的包丢掉
# family = ip
# table = table0
# chain = chain0
# matches = tcp sport 1025 drop
nft add rule table0 chain0 tcp sport 1025 drop
nft add rule table0 chain0 tcp dport 1025 drop

nft add rule inet table0 chain0 tcp dport ssh accept

nft replace rule [<family>] <table> <chain> [handle <handle>] <matches> <statements>
nft replace rule ip table0 chain0 tcp sport 1025 drop
nft replace rule table0 chain1 handle 4 tcp sport 1025 drop

# list table content with handle
nft -a list table table0

# nft delete rule [<family>] <table> <chain> [handle <handle>]
nft delete rule ip table0 chain0 handle 2

# 清空所有规则, 清空所有 table, chain, rule
nft flush ruleset

1
2
3
4

# 列出 ip 族 foo 表的内容
nft list table ip foo # 列出 foo 表的内容

nft list chain filter input # 列出 filter 表 input 链

1
2
3
4
5
6

# nft add table [family] <name>
nft add table ip foo

# 默认簇: ip
nft add table foo

1
2

table <table_address_family> <table_name> {
}

1
2
3
4

nft add rule  <chain-name> ip daddr 8.8.8.8 counter
nft add rule filter input tcp dport 22 accept

nft insert rule nat post ip protocol icmp icmp type echo-request accept

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

# 删除表中所有的规则
# 删除 ip 族 foo 表的内容
nft flush table ip foo

# 按 handle 删除
nft delete rule table0 chain0 handle 4

# 删除指定的链，这里为 input
nft delete chain inet mytable input

1

nft list ruleset> /etc/nftables.conf

1

nft -f /etc/nftables.conf