blob: 98079db103c7bbb812109c3c156f0859b7a3d57e (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
|
#!/usr/sbin/nft -f
table inet overview_test_table {
chain overview_test_chain {
#
# simple selectors
#
# source & destination address
ip saddr 1.1.1.1 ip daddr 2.2.2.2
# tcp or udp ports
tcp dport 123
udp sport 123
# using sets
ip saddr {1.1.1.1, 2.2.2.2} ip daddr {3.3.3.3, 4.4.4.4} tcp dport {22, 80, 443}
# packets meta information: nic names
iifname eth0 oifname eth1
# packets meta information: nic index
iif bond0 oif bond1
# conntrack engine states
ct state new,established
ct state invalid
ct state established,related
#
# simple verdicts (iptables targets)
#
# counter and drop all traffic
counter drop
# accept all traffic
accept
#
# rejecting traffic (more info at http://wiki.nftables.org/)
#
# counter and reject all traffic
counter reject
# reject with a concrete ICMP code
reject with icmp type host-unreachable
# reject with a concrete ICMPv6 code
reject with icmpv6 type no-route
# multi-family reject, using the icmpx keyword
reject with icmpx type admin-prohibited
}
}
|
