nftable, nft basic, commands

1
2
3

sudo pacman -S nftables
sudo systemctl start nftables
sudo systemctl enable nftables

1
2

systemctl disable --now firewalld

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

nft list ruleset # 列出所有规则
nft list tables  # 列出所有表
# 列出每个族的表
nft list tables ip
nft list table ip foo # 列出foo表的内容

nft list chain filter input # 列出filter表input链

# 列出handle
nft -a list table filter

1
2

nft add table [<family>] <name>
nft add table ip foo

1
2

nft add chain [<family>]  <chain-name> { type <type> hook <hook> priority <value> \; [policy <policy>] }
nft add chain filter input { type filter hook input priority 0 \; } # 要和hook (钩子) 相关连

1
2
3
4

nft add rule  <chain-name> ip daddr 8.8.8.8 counter
nft add rule filter input tcp dport 22 accept

nft insert rule nat post ip protocol icmp icmp type echo-request accept

1
2
3
4
5
6
7
8
9

#清空整个规则集
nft flush ruleset
# 删除表中所有的规则
nft flush table ip foo

nft delete table ip foo

# 按 handle 删除
nft delete rule table0 chain0 handle 4

1

nft list ruleset> /etc/nftables.conf

1

nft -f /etc/nftables.conf