6.2. Creating and managing nftables tables, chains, and rules

Procedure 6.4. Creating an nftables table

1. Use the nft add table command to create a new table. For example, to create a table named example_table that processes IPv4 and IPv6 packets:

   # nft add table inet example_table

2. Optionally, list all tables in the rule set:

   # nft list tables
   table inet example_table

Procedure 6.5. Creating an nftables chain

1. Use the nft add chain command to create a new chain. For example, to create a chain named example_chain in example_table:

   # nft add chain inet example_table example_chain '{ type filter hook input priority 0 ; policy accept ; }'

   Important

   To avoid that the shell interprets the semicolons as the end of the command, you must escape the semicolons with a backslash. Moreover, some shells interpret the curly braces as well, so quote the curly braces and anything inside them with ticks (').
   This chain filters incoming packets. The priority parameter specifies the order in which nftables processes chains with the same hook value. A lower priority value has precedence over higher ones. The policy parameter sets the default action for rules in this chain. Note that if you are logged in to the server remotely and you set the default policy to drop, you are disconnected immediately if no other rule allows the remote access.
2. Optionally, display all chains:

   # nft list chains
   table inet example_table {
     chain example_chain {
       type filter hook input priority filter; policy accept;
     }
   }
   

Procedure 6.6. Appending a rule to the end of an nftables chain

1. To add a new rule, use the nft add rule command. For example, to add a rule to the example_chain in the example_table that allows TCP traffic on port 22:

   # nft add rule inet example_table example_chain tcp dport 22 accept

   You can alternatively specify the name of the service instead of the port number. In the example, you could use ssh instead of the port number 22. Note that a service name is resolved to a port number based on its entry in the /etc/services file.
2. Optionally, display all chains and their rules in example_table:

   # nft list table inet example_table
   table inet example_table {
     chain example_chain {
       type filter hook input priority filter; policy accept;
       ...
       tcp dport ssh accept
     }
   }
   

Procedure 6.7. Inserting a rule at the beginning of an nftables chain

1. To insert a new rule, use the nft insert rule command. For example, to insert a rule to the example_chain in the example_table that allows TCP traffic on port 22:

   # nft insert rule inet example_table example_chain tcp dport 22 accept

   You can alternatively specify the name of the service instead of the port number. In the example, you could use ssh instead of the port number 22. Note that a service name is resolved to a port number based on its entry in the /etc/services file.
2. Optionally, display all chains and their rules in example_table:

   # nft list table inet example_table
   table inet example_table {
     chain example_chain {
       type filter hook input priority filter; policy accept;
       tcp dport ssh accept
       ...
     }
   }
   

Procedure 6.8. Inserting a rule at a specific position of an nftables chain

1. Use the nft -a list ruleset command to display all chains and their rules in the example_table including their handle:

   # nft -a list table inet example_table
   table inet example_table { # handle 1
     chain example_chain { # handle 1
       type filter hook input priority filter; policy accept;
       tcp dport 22 accept # handle 2
       tcp dport 443 accept # handle 3
       tcp dport 389 accept # handle 4
     }
   }
   

   Using the -a displays the handles. You require this information to position the new rules in the next steps.
2. Insert the new rules to the example_chain chain in the example_table:
   • To insert a rule that allows TCP traffic on port 636 before handle 3, enter:

     # nft insert rule inet example_table example_chain position 3 tcp dport 636 accept

   • To add a rule that allows TCP traffic on port 80 after handle 3, enter:

     # nft add rule inet example_table example_chain position 3 tcp dport 80 accept

3. Optionally, display all chains and their rules in example_table:

   # nft -a list table inet example_table
   table inet example_table { # handle 1
     chain example_chain { # handle 1
       type filter hook input priority filter; policy accept;
       tcp dport 22 accept # handle 2
       tcp dport 636 accept # handle 5
       tcp dport 443 accept # handle 3
       tcp dport 80 accept # handle 6
       tcp dport 389 accept # handle 4
     }
   }