Gecko [ v99win.today ]

/ usr / share / doc / nftables / examples / [ HOME SHELL ]

Name	Size	Permission	Action
sysvinit	[ DIR ]	drwxr-xr-x
README	475 B	-rw-r--r--
all-in-one.nft	1016 B	-rw-r--r--
arp-filter.nft	129 B	-rw-r--r--
bridge-filter.nft	197 B	-rw-r--r--
ct_helpers.nft	1.23 KB	-rwxr-xr-x
inet-filter.nft	187 B	-rw-r--r--
inet-nat.nft	251 B	-rw-r--r--
ipv4-filter.nft	182 B	-rw-r--r--
ipv4-mangle.nft	74 B	-rw-r--r--
ipv4-nat.nft	246 B	-rw-r--r--
ipv4-raw.nft	137 B	-rw-r--r--
ipv6-filter.nft	186 B	-rw-r--r--
ipv6-mangle.nft	78 B	-rw-r--r--
ipv6-nat.nft	253 B	-rw-r--r--
ipv6-raw.nft	141 B	-rw-r--r--
load_balancing.nft	1.81 KB	-rwxr-xr-x
nat.nft	1.14 KB	-rwxr-xr-x
netdev-ingress.nft	128 B	-rw-r--r--
overview.nft	1.05 KB	-rwxr-xr-x
pf.os	28.21 KB	-rw-r--r--
secmark.nft	2.35 KB	-rwxr-xr-x
sets_and_maps.nft	1.25 KB	-rwxr-xr-x
workstation.nft	817 B	-rwxr-xr-x

Code Editor : overview.nft

#!/usr/sbin/nft -f

table inet overview_test_table {
	chain overview_test_chain {
		#
		# simple selectors
		#

# source & destination address
		ip saddr 1.1.1.1 ip daddr 2.2.2.2

# tcp or udp ports
		tcp dport 123
		udp sport 123

# using sets
		ip saddr {1.1.1.1, 2.2.2.2} ip daddr {3.3.3.3, 4.4.4.4} tcp dport {22, 80, 443}

# packets meta information: nic names
		iifname eth0 oifname eth1

# packets meta information: nic index
		iif bond0 oif bond1

# conntrack engine states
		ct state new,established
		ct state invalid
		ct state established,related

#
		# simple verdicts (iptables targets)
		#

# counter and drop all traffic
		counter drop

# accept all traffic
		accept

#
		# rejecting traffic (more info at http://wiki.nftables.org/)
		#

# counter and reject all traffic
		counter reject

# reject with a concrete ICMP code
		reject with icmp type host-unreachable

# reject with a concrete ICMPv6 code
		reject with icmpv6 type no-route

# multi-family reject, using the icmpx keyword
		reject with icmpx type admin-prohibited
	}
}