Red Hat Summit Red Hat Summitサポートコンソール開発者トライアルの開始お問い合わせ

2.6. Writing and executing nftables scripts

The major benefit of using the nftables framework is that the execution of scripts is atomic. This means that the system either applies the whole script or prevents the execution if an error occurs. This guarantees that the firewall is always in a consistent state.

Additionally, with the nftables script environment, you can:

  • Add comments
  • Define variables
  • Include other rule set files

When you install the nftables package, RHEL automatically creates *.nft scripts in the /etc/nftables/ directory. These scripts contain commands that create tables and empty chains for different purposes.

2.6.1. Supported nftables script formats
リンクのコピー

The nftables framework supports scripts in different formats.

You can use the following formats:

  • The same format as the nft list ruleset command displays the rule set: 

    #!/usr/sbin/nft -f

# Flush the rule set
flush ruleset

table inet example_table {
  chain example_chain {
    # Chain for incoming packets that drops all packets that
    # are not explicitly allowed by any rule in this chain
    type filter hook input priority 0; policy drop;

    # Accept connections to port 22 (ssh)
    tcp dport ssh accept
  }
}

  • The same syntax as for nft commands: 

    #!/usr/sbin/nft -f

# Flush the rule set
flush ruleset

# Create a table
add table inet example_table

# Create a chain for incoming packets that drops all packets
# that are not explicitly allowed by any rule in this chain
add chain inet example_table example_chain { type filter hook input priority 0 ; policy drop ; }

# Add a rule that accepts connections to port 22 (ssh)
add rule inet example_table example_chain tcp dport ssh accept

2.6.2. Running nftables scripts
リンクのコピー

You can run an nftables script either by passing it to the nft utility or by executing the script directly.

Procedure

  • To run an nftables script by passing it to the nft utility, enter: 

    # nft -f /etc/nftables/<example_firewall_script>.nft

  • To run an nftables script directly:

    1. For the single time that you perform this:

      1. Ensure that the script starts with the following shebang sequence: 

        #!/usr/sbin/nft -f
        重要

        If you omit the -f parameter, the nft utility does not read the script and displays: Error: syntax error, unexpected newline, expecting string.

      2. Optional: Set the owner of the script to root: 

        # chown root /etc/nftables/<example_firewall_script>.nft

      3. Make the script executable for the owner: 

        # chmod u+x /etc/nftables/<example_firewall_script>.nft

    2. Run the script: 

      # /etc/nftables/<example_firewall_script>.nft

      If no output is displayed, the system executed the script successfully.

      重要

      Even if nft executes the script successfully, incorrectly placed rules, missing parameters, or other problems in the script can cause that the firewall behaves not as expected.

2.6.3. Using comments in nftables scripts
リンクのコピー

The nftables scripting environment interprets everything to the right of a # character to the end of a line as a comment.

Comments can start at the beginning of a line, or next to a command: 

...
# Flush the rule set
flush ruleset

add table inet example_table  # Create a table
...

2.6.4. Using variables in nftables script
リンクのコピー

To define a variable in an nftables script, use the define keyword. You can store single values and anonymous sets in a variable. For more complex scenarios, use sets or verdict maps.

Variables with a single value

The following example defines a variable named INET_DEV with the value enp1s0: 

define INET_DEV = enp1s0

You can use the variable in the script by entering the $ sign followed by the variable name: 

...
add rule inet example_table example_chain iifname $INET_DEV tcp dport ssh accept
...
Variables that contain an anonymous set

The following example defines a variable that contains an anonymous set: 

define DNS_SERVERS = { 192.0.2.1, 192.0.2.2 }

You can use the variable in the script by writing the $ sign followed by the variable name: 

add rule inet example_table example_chain ip daddr $DNS_SERVERS accept
注記

Curly braces have special semantics when you use them in a rule because they indicate that the variable represents a set.

2.6.5. Including files in nftables scripts
リンクのコピー

In the nftables scripting environment, you can include other scripts by using the include statement.

If you specify only a file name without an absolute or relative path, nftables includes files from the default search path, which is set to /etc on RHEL.

例2.1 Including files from the default search directory

To include a file from the default search directory: 

include "example.nft"

例2.2 Including all *.nft files from a directory

To include all files ending with *.nft that are stored in the /etc/nftables/rulesets/ directory: 

include "/etc/nftables/rulesets/*.nft"

Note that the include statement does not match files beginning with a dot.

For more details, see the Include files section in the nft(8) man page on your system.

2.6.6. Automatically loading nftables rules when the system boots
リンクのコピー

The nftables systemd service loads firewall scripts that are included in the /etc/sysconfig/nftables.conf file.

Prerequisites

  • The nftables scripts are stored in the /etc/nftables/ directory.

Procedure

  1. Edit the /etc/sysconfig/nftables.conf file.

    • If you modified the *.nft scripts that were created in /etc/nftables/ with the installation of the nftables package, uncomment the include statement for these scripts.

    • If you wrote new scripts, add include statements to include these scripts. For example, to load the /etc/nftables/example.nft script when the nftables service starts, add: 

      include "/etc/nftables/example.nft"

  2. Optional: Start the nftables service to load the firewall rules without rebooting the system: 

    # systemctl start nftables

  3. Enable the nftables service. 

    # systemctl enable nftables
Red Hat logoGithubredditYoutubeTwitter

詳細情報

試用、購入および販売

コミュニティー

Red Hat ドキュメントについて

Red Hat をお使いのお客様が、信頼できるコンテンツが含まれている製品やサービスを活用することで、イノベーションを行い、目標を達成できるようにします。 最新の更新を見る.

多様性を受け入れるオープンソースの強化

Red Hat では、コード、ドキュメント、Web プロパティーにおける配慮に欠ける用語の置き換えに取り組んでいます。このような変更は、段階的に実施される予定です。詳細情報: Red Hat ブログ.

会社概要

Red Hat は、企業がコアとなるデータセンターからネットワークエッジに至るまで、各種プラットフォームや環境全体で作業を簡素化できるように、強化されたソリューションを提供しています。

Theme

© 2026 Red Hatトップに戻る