Chapter 8. Getting started with nftables

Procedure

1. Create a table named nftables_svc with the inet address family so that the table can process both IPv4 and IPv6 packets:

   # nft add table inet nftables_svc

   Copy to Clipboard Toggle word wrap

2. Add a base chain named INPUT, that processes incoming network traffic, to the inet nftables_svc table:

   # nft add chain inet nftables_svc INPUT { type filter hook input priority filter \; policy accept \; }

   Copy to Clipboard Toggle word wrap

   To avoid that the shell interprets the semicolons as the end of the command, escape the semicolons using the \ character.

3. Add rules to the INPUT chain. For example, allow incoming TCP traffic on port 22 and 443, and, as the last rule of the INPUT chain, reject other incoming traffic with an Internet Control Message Protocol (ICMP) port unreachable message:

   # nft add rule inet nftables_svc INPUT tcp dport 22 accept
   # nft add rule inet nftables_svc INPUT tcp dport 443 accept
   # nft add rule inet nftables_svc INPUT reject with icmpx type port-unreachable

   Copy to Clipboard Toggle word wrap

   If you enter the nft add rule commands as shown, nft adds the rules in the same order to the chain as you run the commands.

4. Display the current rule set including handles:

   # nft -a list table inet nftables_svc
   table inet nftables_svc { # handle 13
     chain INPUT { # handle 1
       type filter hook input priority filter; policy accept;
       tcp dport 22 accept # handle 2
       tcp dport 443 accept # handle 3
       reject # handle 4
     }
   }

   Copy to Clipboard Toggle word wrap

5. Insert a rule before the existing rule with handle 3. For example, to insert a rule that allows TCP traffic on port 636, enter:

   # nft insert rule inet nftables_svc INPUT position 3 tcp dport 636 accept

   Copy to Clipboard Toggle word wrap

6. Append a rule after the existing rule with handle 3. For example, to insert a rule that allows TCP traffic on port 80, enter:

   # nft add rule inet nftables_svc INPUT position 3 tcp dport 80 accept

   Copy to Clipboard Toggle word wrap

7. Display the rule set again with handles. Verify that the later added rules have been added to the specified positions:

   # nft -a list table inet nftables_svc
   table inet nftables_svc { # handle 13
     chain INPUT { # handle 1
       type filter hook input priority filter; policy accept;
       tcp dport 22 accept # handle 2
       tcp dport 636 accept # handle 5
       tcp dport 443 accept # handle 3
       tcp dport 80 accept # handle 6
       reject # handle 4
     }
   }

   Copy to Clipboard Toggle word wrap

8. Remove the rule with handle 6:

   # nft delete rule inet nftables_svc INPUT handle 6

   Copy to Clipboard Toggle word wrap

   To remove a rule, you must specify the handle.

9. Display the rule set, and verify that the removed rule is no longer present:

   # nft -a list table inet nftables_svc
   table inet nftables_svc { # handle 13
     chain INPUT { # handle 1
       type filter hook input priority filter; policy accept;
       tcp dport 22 accept # handle 2
       tcp dport 636 accept # handle 5
       tcp dport 443 accept # handle 3
       reject # handle 4
     }
   }

   Copy to Clipboard Toggle word wrap

10. Remove all remaining rules from the INPUT chain:

    # nft flush chain inet nftables_svc INPUT

    Copy to Clipboard Toggle word wrap

11. Display the rule set, and verify that the INPUT chain is empty:

    # nft list table inet nftables_svc
    table inet nftables_svc {
      chain INPUT {
        type filter hook input priority filter; policy accept
      }
    }

    Copy to Clipboard Toggle word wrap

12. Delete the INPUT chain:

    # nft delete chain inet nftables_svc INPUT

    Copy to Clipboard Toggle word wrap

    You can also use this command to delete chains that still contain rules.

13. Display the rule set, and verify that the INPUT chain has been deleted:

    # nft list table inet nftables_svc
    table inet nftables_svc {
    }

    Copy to Clipboard Toggle word wrap

14. Delete the nftables_svc table:

    # nft delete table inet nftables_svc

    Copy to Clipboard Toggle word wrap

    You can also use this command to delete tables that still contain chains.

    Note

    To delete the entire rule set, use the nft flush ruleset command instead of manually deleting all rules, chains, and tables in separate commands.

Procedure

1. Write the iptables and ip6tables rules to a file:

   # iptables-save >/root/iptables.dump
   # ip6tables-save >/root/ip6tables.dump

   Copy to Clipboard Toggle word wrap

2. Convert the dump files to nftables instructions:

   # iptables-restore-translate -f /root/iptables.dump > /etc/nftables/ruleset-migrated-from-iptables.nft
   # ip6tables-restore-translate -f /root/ip6tables.dump > /etc/nftables/ruleset-migrated-from-ip6tables.nft

   Copy to Clipboard Toggle word wrap
3. Review and, if needed, manually update the generated nftables rules.

4. To enable the nftables service to load the generated files, add the following to the /etc/sysconfig/nftables.conf file:

   include "/etc/nftables/ruleset-migrated-from-iptables.nft"
   include "/etc/nftables/ruleset-migrated-from-ip6tables.nft"

   Copy to Clipboard Toggle word wrap

5. Stop and disable the iptables service:

   # systemctl disable --now iptables

   Copy to Clipboard Toggle word wrap

   If you used a custom script to load the iptables rules, ensure that the script no longer starts automatically and reboot to flush all tables.

6. Enable and start the nftables service:

   # systemctl enable --now nftables

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a table:

   # nft add table nat

   Copy to Clipboard Toggle word wrap

2. Add the prerouting and postrouting chains to the table:

   # nft add chain nat postrouting { type nat hook postrouting priority 100 \; }

   Copy to Clipboard Toggle word wrap
   Important

   Even if you do not add a rule to the prerouting chain, the nftables framework requires this chain to match incoming packet replies.

   Note that you must pass the -- option to the nft command to prevent the shell from interpreting the negative priority value as an option of the nft command.

3. Add a rule to the postrouting chain that matches outgoing packets on the ens3 interface:

   # nft add rule nat postrouting oifname "ens3" masquerade

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a table:

   # nft add table nat

   Copy to Clipboard Toggle word wrap

2. Add the prerouting and postrouting chains to the table:

   # nft add chain nat postrouting { type nat hook postrouting priority 100 \; }

   Copy to Clipboard Toggle word wrap
   Important

   Even if you do not add a rule to the postrouting chain, the nftables framework requires this chain to match outgoing packet replies.

   Note that you must pass the -- option to the nft command to prevent the shell from interpreting the negative priority value as an option of the nft command.

3. Add a rule to the postrouting chain that replaces the source IP of outgoing packets through ens3 with 192.0.2.1:

   # nft add rule nat postrouting oifname "ens3" snat to 192.0.2.1

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a table:

   # nft add table nat

   Copy to Clipboard Toggle word wrap

2. Add the prerouting and postrouting chains to the table:

   # nft -- add chain nat prerouting { type nat hook prerouting priority -100 \; }
   # nft add chain nat postrouting { type nat hook postrouting priority 100 \; }

   Copy to Clipboard Toggle word wrap
   Important

   Even if you do not add a rule to the postrouting chain, the nftables framework requires this chain to match outgoing packet replies.

   Note that you must pass the -- option to the nft command to prevent the shell from interpreting the negative priority value as an option of the nft command.

3. Add a rule to the prerouting chain that redirects incoming traffic to port 80 and 443 on the ens3 interface of the router to the web server with the IP address 192.0.2.1:

   # nft add rule nat prerouting iifname ens3 tcp dport { 80, 443 } dnat to 192.0.2.1

   Copy to Clipboard Toggle word wrap

4. Depending on your environment, add either a SNAT or masquerading rule to change the source address for packets returning from the web server to the sender:

   1. If the ens3 interface uses a dynamic IP addresses, add a masquerading rule:

      # nft add rule nat postrouting oifname "ens3" masquerade

      Copy to Clipboard Toggle word wrap

   2. If the ens3 interface uses a static IP address, add a SNAT rule. For example, if the ens3 uses the 198.51.100.1 IP address:

      # nft add rule nat postrouting oifname "ens3" snat to 198.51.100.1

      Copy to Clipboard Toggle word wrap

5. Enable packet forwarding:

   # echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf
   # sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a table:

   # nft add table nat

   Copy to Clipboard Toggle word wrap

2. Add the prerouting chain to the table:

   # nft -- add chain nat prerouting { type nat hook prerouting priority -100 \; }

   Copy to Clipboard Toggle word wrap

   Note that you must pass the -- option to the nft command to prevent the shell from interpreting the negative priority value as an option of the nft command.

3. Add a rule to the prerouting chain that redirects incoming traffic on port 22 to port 2222:

   # nft add rule nat prerouting tcp dport 22 redirect to 2222

   Copy to Clipboard Toggle word wrap

Procedure

1. Edit the /etc/sysconfig/nftables.conf file.

   • If you modified the *.nft scripts that were created in /etc/nftables/ with the installation of the nftables package, uncomment the include statement for these scripts.

   • If you wrote new scripts, add include statements to include these scripts. For example, to load the /etc/nftables/example.nft script when the nftables service starts, add:

     include "/etc/nftables/_example_.nft"

     Copy to Clipboard Toggle word wrap

2. Optional: Start the nftables service to load the firewall rules without rebooting the system:

   # systemctl start nftables

   Copy to Clipboard Toggle word wrap

3. Enable the nftables service.

   # systemctl enable nftables

   Copy to Clipboard Toggle word wrap

Procedure

1. For example, to add a rule to example_chain in example_table that allows incoming traffic to port 22, 80, and 443:

   # nft add rule inet example_table example_chain tcp dport { 22, 80, 443 } accept

   Copy to Clipboard Toggle word wrap

2. Optional: Display all chains and their rules in example_table:

   # nft list table inet example_table
   table inet example_table {
     chain example_chain {
       type filter hook input priority filter; policy accept;
       tcp dport { ssh, http, https } accept
     }
   }

   Copy to Clipboard Toggle word wrap

Procedure

1. Create an empty set. The following examples create a set for IPv4 addresses:

   • To create a set that can store multiple individual IPv4 addresses:

     # nft add set inet example_table example_set { type ipv4_addr \; }

     Copy to Clipboard Toggle word wrap

   • To create a set that can store IPv4 address ranges:

     # nft add set inet example_table example_set { type ipv4_addr \; flags interval \; }

     Copy to Clipboard Toggle word wrap
   Important

   To prevent the shell from interpreting the semicolons as the end of the command, you must escape the semicolons with a backslash.

2. Optional: Create rules that use the set. For example, the following command adds a rule to the example_chain in the example_table that will drop all packets from IPv4 addresses in example_set.

   # nft add rule inet example_table example_chain ip saddr @example_set drop

   Copy to Clipboard Toggle word wrap

   Because example_set is still empty, the rule has currently no effect.

3. Add IPv4 addresses to example_set:

   • If you create a set that stores individual IPv4 addresses, enter:

     # nft add element inet example_table example_set { 192.0.2.1, 192.0.2.2 }

     Copy to Clipboard Toggle word wrap

   • If you create a set that stores IPv4 ranges, enter:

     # nft add element inet example_table example_set { 192.0.2.0-192.0.2.255 }

     Copy to Clipboard Toggle word wrap

     When you specify an IP address range, you can alternatively use the Classless Inter-Domain Routing (CIDR) notation, such as 192.0.2.0/24 in the above example.

Procedure

1. Create an empty set. The following examples create a set for IPv4 addresses:

   • To create a set that can store multiple individual IPv4 addresses:

     # nft add set inet example_table example_set { type ipv4_addr \; }

     Copy to Clipboard Toggle word wrap

   • To create a set that can store IPv4 address ranges:

     # nft add set inet example_table example_set { type ipv4_addr \; flags interval \; }

     Copy to Clipboard Toggle word wrap
     Important

     To prevent the shell from interpreting the semicolons as the end of the command, you must escape the semicolons with a backslash.

2. Create a rule for dynamically adding the source IPv4 addresses of incoming packets to the example_set set:

   # nft add rule inet example_table example_chain set add ip saddr @example_set

   Copy to Clipboard Toggle word wrap

   The command creates a new rule within the example_chain rule chain and the example_table to dynamically add the source IPv4 address of the packet to the example_set.

Procedure

1. Create a new table:

   # nft add table inet example_table

   Copy to Clipboard Toggle word wrap

2. Create the tcp_packets chain in example_table:

   # nft add chain inet example_table tcp_packets

   Copy to Clipboard Toggle word wrap

3. Add a rule to tcp_packets that counts the traffic in this chain:

   # nft add rule inet example_table tcp_packets counter

   Copy to Clipboard Toggle word wrap

4. Create the udp_packets chain in example_table

   # nft add chain inet example_table udp_packets

   Copy to Clipboard Toggle word wrap

5. Add a rule to udp_packets that counts the traffic in this chain:

   # nft add rule inet example_table udp_packets counter

   Copy to Clipboard Toggle word wrap

6. Create a chain for incoming traffic. For example, to create a chain named incoming_traffic in example_table that filters incoming traffic:

   # nft add chain inet example_table incoming_traffic { type filter hook input priority 0 \; }

   Copy to Clipboard Toggle word wrap

7. Add a rule with an anonymous map to incoming_traffic:

   # nft add rule inet example_table incoming_traffic ip protocol vmap { tcp : jump tcp_packets, udp : jump udp_packets }

   Copy to Clipboard Toggle word wrap

   The anonymous map distinguishes the packets and sends them to the different counter chains based on their protocol.

8. To list the traffic counters, display example_table:

   # nft list table inet example_table
   table inet example_table {
     chain tcp_packets {
       counter packets 36379 bytes 2103816
     }
   
     chain udp_packets {
       counter packets 10 bytes 1559
     }
   
     chain incoming_traffic {
       type filter hook input priority filter; policy accept;
       ip protocol vmap { tcp : jump tcp_packets, udp : jump udp_packets }
     }
   }

   Copy to Clipboard Toggle word wrap

   The counters in the tcp_packets and udp_packets chain display both the number of received packets and bytes.

Procedure

1. Create a table. For example, to create a table named example_table that processes IPv4 packets:

   # nft add table ip example_table

   Copy to Clipboard Toggle word wrap

2. Create a chain. For example, to create a chain named example_chain in example_table:

   # nft add chain ip example_table example_chain { type filter hook input priority 0 \; }

   Copy to Clipboard Toggle word wrap
   Important

   To prevent the shell from interpreting the semicolons as the end of the command, you must escape the semicolons with a backslash.

3. Create an empty map. For example, to create a map for IPv4 addresses:

   # nft add map ip example_table example_map { type ipv4_addr : verdict \; }

   Copy to Clipboard Toggle word wrap

4. Create rules that use the map. For example, the following command adds a rule to example_chain in example_table that applies actions to IPv4 addresses which are both defined in example_map:

   # nft add rule example_table example_chain ip saddr vmap @example_map

   Copy to Clipboard Toggle word wrap

5. Add IPv4 addresses and corresponding actions to example_map:

   # nft add element ip example_table example_map { 192.0.2.1 : accept, 192.0.2.2 : drop }

   Copy to Clipboard Toggle word wrap

   This example defines the mappings of IPv4 addresses to actions. In combination with the rule created above, the firewall accepts packet from 192.0.2.1 and drops packets from 192.0.2.2.

6. Optional: Enhance the map by adding another IP address and action statement:

   # nft add element ip example_table example_map { 192.0.2.3 : accept }

   Copy to Clipboard Toggle word wrap

7. Optional: Remove an entry from the map:

   # nft delete element ip example_table example_map { 192.0.2.1 }

   Copy to Clipboard Toggle word wrap

8. Optional: Display the rule set:

   # nft list ruleset
   table ip example_table {
     map example_map {
       type ipv4_addr : verdict
       elements = { 192.0.2.2 : drop, 192.0.2.3 : accept }
     }
   
     chain example_chain {
       type filter hook input priority filter; policy accept;
       ip saddr vmap @example_map
     }
   }

   Copy to Clipboard Toggle word wrap

Procedure

1. Create the /etc/rsyslog.d/nftables.conf file with the following content:

   :msg, startswith, "nft drop" -/var/log/nftables.log
   & stop

   Copy to Clipboard Toggle word wrap

   Using this configuration, the rsyslog service logs dropped packets to the /var/log/nftables.log file instead of /var/log/messages.

2. Restart the rsyslog service:

   # systemctl restart rsyslog

   Copy to Clipboard Toggle word wrap

3. Create the /etc/logrotate.d/nftables file with the following content to rotate /var/log/nftables.log if the size exceeds 10 MB:

   /var/log/nftables.log {
     size +10M
     maxage 30
     sharedscripts
     postrotate
       /usr/bin/systemctl kill -s HUP rsyslog.service >/dev/null 2>&1 || true
     endscript
   }

   Copy to Clipboard Toggle word wrap

   The maxage 30 setting defines that logrotate removes rotated logs older than 30 days during the next rotation operation.

Procedure

1. Create the /etc/nftables/firewall.nft script with the following content:

   # Remove all rules
   flush ruleset
   
   
   # Table for both IPv4 and IPv6 rules
   table inet nftables_svc {
   
     # Define variables for the interface name
     define INET_DEV = enp1s0
     define LAN_DEV  = enp7s0
     define DMZ_DEV  = enp8s0
   
   
     # Set with the IPv4 addresses of admin PCs
     set admin_pc_ipv4 {
       type ipv4_addr
       elements = { 10.0.0.100, 10.0.0.200 }
     }
   
   
     # Chain for incoming trafic. Default policy: drop
     chain INPUT {
       type filter hook input priority filter
       policy drop
   
       # Accept packets in established and related state, drop invalid packets
       ct state vmap { established:accept, related:accept, invalid:drop }
   
       # Accept incoming traffic on loopback interface
       iifname lo accept
   
       # Allow request from LAN and DMZ to local DNS server
       iifname { $LAN_DEV, $DMZ_DEV } meta l4proto { tcp, udp } th dport 53 accept
   
       # Allow admins PCs to access the router using SSH
       iifname $LAN_DEV ip saddr @admin_pc_ipv4 tcp dport 22 accept
   
       # Last action: Log blocked packets
       # (packets that were not accepted in previous rules in this chain)
       log prefix "nft drop IN : "
     }
   
   
     # Chain for outgoing traffic. Default policy: drop
     chain OUTPUT {
       type filter hook output priority filter
       policy drop
   
       # Accept packets in established and related state, drop invalid packets
       ct state vmap { established:accept, related:accept, invalid:drop }
   
       # Accept outgoing traffic on loopback interface
       oifname lo accept
   
       # Allow local DNS server to recursively resolve queries
       oifname $INET_DEV meta l4proto { tcp, udp } th dport 53 accept
   
       # Last action: Log blocked packets
       log prefix "nft drop OUT: "
     }
   
   
     # Chain for forwarding traffic. Default policy: drop
     chain FORWARD {
       type filter hook forward priority filter
       policy drop
   
       # Accept packets in established and related state, drop invalid packets
       ct state vmap { established:accept, related:accept, invalid:drop }
   
       # IPv4 access from LAN and internet to the HTTPS server in the DMZ
       iifname { $LAN_DEV, $INET_DEV } oifname $DMZ_DEV ip daddr 198.51.100.5 tcp dport 443 accept
   
       # IPv6 access from internet to the HTTPS server in the DMZ
       iifname $INET_DEV oifname $DMZ_DEV ip6 daddr 2001:db8:b::5 tcp dport 443 accept
   
       # Access from LAN and DMZ to HTTPS servers on the internet
       iifname { $LAN_DEV, $DMZ_DEV } oifname $INET_DEV tcp dport 443 accept
   
       # Last action: Log blocked packets
       log prefix "nft drop FWD: "
     }
   
   
     # Postrouting chain to handle SNAT
     chain postrouting {
       type nat hook postrouting priority srcnat; policy accept;
   
       # SNAT for IPv4 traffic from LAN to internet
       iifname $LAN_DEV oifname $INET_DEV snat ip to 203.0.113.1
     }
   }

   Copy to Clipboard Toggle word wrap

2. Include the /etc/nftables/firewall.nft script in the /etc/sysconfig/nftables.conf file:

   include "/etc/nftables/firewall.nft"

   Copy to Clipboard Toggle word wrap

3. Enable IPv4 forwarding:

   # echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf
   # sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf

   Copy to Clipboard Toggle word wrap

4. Enable and start the nftables service:

   # systemctl enable --now nftables

   Copy to Clipboard Toggle word wrap

Verification

1. Optional: Verify the nftables rule set:

   # nft list ruleset
   ...

   Copy to Clipboard Toggle word wrap

2. Try to perform an access that the firewall prevents. For example, try to access the router using SSH from the DMZ:

   # ssh router.example.com
   ssh: connect to host router.example.com port 22: Network is unreachable

   Copy to Clipboard Toggle word wrap

3. Depending on your logging settings, search:

   • The systemd journal for the blocked packets:

     # journalctl -k -g "nft drop"
     Oct 14 17:27:18 router kernel: nft drop IN : IN=enp8s0 OUT= MAC=... SRC=198.51.100.5 DST=198.51.100.1 ... PROTO=TCP SPT=40464 DPT=22 ... SYN ...

     Copy to Clipboard Toggle word wrap

   • The /var/log/nftables.log file for the blocked packets:

     Oct 14 17:27:18 router kernel: nft drop IN : IN=enp8s0 OUT= MAC=... SRC=198.51.100.5 DST=198.51.100.1 ... PROTO=TCP SPT=40464 DPT=22 ... SYN ...

     Copy to Clipboard Toggle word wrap

Procedure

1. Create the filter table with the inet address family:

   # nft add table inet filter

   Copy to Clipboard Toggle word wrap

2. Add the input chain to the inet filter table:

   # nft add chain inet filter input { type filter hook input priority 0 \; }

   Copy to Clipboard Toggle word wrap

3. Create a dynamic set for IPv4 addresses:

   # nft add set inet filter limit-ssh { type ipv4_addr\; flags dynamic \;}

   Copy to Clipboard Toggle word wrap

4. Add a rule to the input chain that allows only two simultaneous incoming connections to the SSH port (22) from an IPv4 address and rejects all further connections from the same IP:

   # nft add rule inet filter input tcp dport ssh ct state new add @limit-ssh { ip saddr ct count over 2 } counter reject

   Copy to Clipboard Toggle word wrap

Verification

1. Establish more than two new simultaneous SSH connections from the same IP address to the host. Nftables refuses connections to the SSH port if two connections are already established.

2. Display the limit-ssh dynamic set:

   # nft list set inet filter limit-ssh
   table inet filter {
     set limit-ssh {
       type ipv4_addr
       size 65535
       flags dynamic
       elements = { 192.0.2.1 ct count over 2 , 192.0.2.2 ct count over 2 }
     }
   }

   Copy to Clipboard Toggle word wrap

   The elements entry displays addresses that currently match the rule. In this example, elements lists IP addresses that have active connections to the SSH port. Note that the output does not display the number of active connections or if connections were rejected.

Procedure

1. Create the filter table with the ip address family:

   # nft add table ip filter

   Copy to Clipboard Toggle word wrap

2. Add the input chain to the filter table:

   # nft add chain ip filter input { type filter hook input priority 0 \; }

   Copy to Clipboard Toggle word wrap

3. Add a rule that drops all packets from source addresses that attempt to establish more than ten TCP connections within one minute:

   # nft add rule ip filter input ip protocol tcp ct state new, untracked meter ratemeter { ip saddr timeout 5m limit rate over 10/minute } drop

   Copy to Clipboard Toggle word wrap

   The timeout 5m parameter defines that nftables automatically removes entries after five minutes to prevent that the meter fills up with stale entries.

Procedure

1. Add a new rule with the counter parameter to the chain. The following example adds a rule with a counter that allows TCP traffic on port 22 and counts the packets and traffic that match this rule:

   # nft add rule inet example_table example_chain tcp dport 22 counter accept

   Copy to Clipboard Toggle word wrap

2. To display the counter values:

   # nft list ruleset
   table inet example_table {
     chain example_chain {
       type filter hook input priority filter; policy accept;
       tcp dport ssh counter packets 6872 bytes 105448565 accept
     }
   }

   Copy to Clipboard Toggle word wrap

Procedure

1. Display the rules in the chain including their handles:

   # nft --handle list chain inet example_table example_chain
   table inet example_table {
     chain example_chain { # handle 1
       type filter hook input priority filter; policy accept;
       tcp dport ssh accept # handle 4
     }
   }

   Copy to Clipboard Toggle word wrap

2. Add the counter by replacing the rule but with the counter parameter. The following example replaces the rule displayed in the previous step and adds a counter:

   # nft replace rule inet example_table example_chain handle 4 tcp dport 22 counter accept

   Copy to Clipboard Toggle word wrap

3. To display the counter values:

   # nft list ruleset
   table inet example_table {
     chain example_chain {
       type filter hook input priority filter; policy accept;
       tcp dport ssh counter packets 6872 bytes 105448565 accept
     }
   }

   Copy to Clipboard Toggle word wrap

Procedure

1. Display the rules in the chain including their handles:

   # nft --handle list chain inet example_table example_chain
   table inet example_table {
     chain example_chain { # handle 1
       type filter hook input priority filter; policy accept;
       tcp dport ssh accept # handle 4
     }
   }

   Copy to Clipboard Toggle word wrap

2. Add the tracing feature by replacing the rule but with the meta nftrace set 1 parameters. The following example replaces the rule displayed in the previous step and enables tracing:

   # nft replace rule inet example_table example_chain handle 4 tcp dport 22 meta nftrace set 1 accept

   Copy to Clipboard Toggle word wrap

3. Use the nft monitor command to display the tracing. The following example filters the output of the command to display only entries that contain inet example_table example_chain:

   # nft monitor | grep "inet example_table example_chain"
   trace id 3c5eb15e inet example_table example_chain packet: iif "enp1s0" ether saddr 52:54:00:17:ff:e4 ether daddr 52:54:00:72:2f:6e ip saddr 192.0.2.1 ip daddr 192.0.2.2 ip dscp cs0 ip ecn not-ect ip ttl 64 ip id 49710 ip protocol tcp ip length 60 tcp sport 56728 tcp dport ssh tcp flags == syn tcp window 64240
   trace id 3c5eb15e inet example_table example_chain rule tcp dport ssh nftrace set 1 accept (verdict accept)
   ...

   Copy to Clipboard Toggle word wrap
   Warning

   Depending on the number of rules with tracing enabled and the amount of matching traffic, the nft monitor command can display a lot of output. Use grep or other utilities to filter the output.