1#@!#!123s

: / usr / share / doc / nftables / examples /
Filename : overview.nft
back
#!/usr/sbin/nft -f

table inet overview_test_table {
	chain overview_test_chain {
		#
		# simple selectors
		#

		# source & destination address
		ip saddr 1.1.1.1 ip daddr 2.2.2.2

		# tcp or udp ports
		tcp dport 123
		udp sport 123

		# using sets
		ip saddr {1.1.1.1, 2.2.2.2} ip daddr {3.3.3.3, 4.4.4.4} tcp dport {22, 80, 443}

		# packets meta information: nic names
		iifname eth0 oifname eth1

		# packets meta information: nic index
		iif bond0 oif bond1

		# conntrack engine states
		ct state new,established
		ct state invalid
		ct state established,related

		#
		# simple verdicts (iptables targets)
		#

		# counter and drop all traffic
		counter drop

		# accept all traffic
		accept

		#
		# rejecting traffic (more info at http://wiki.nftables.org/)
		#

		# counter and reject all traffic
		counter reject

		# reject with a concrete ICMP code
		reject with icmp type host-unreachable

		# reject with a concrete ICMPv6 code
		reject with icmpv6 type no-route

		# multi-family reject, using the icmpx keyword
		reject with icmpx type admin-prohibited
	}
}