6.5. Using verdict maps in nftables commands

Procedure 6.15. Using anonymous maps in nftables

1. Create the example_table:

   # nft add table inet example_table

   Copy to Clipboard Toggle word wrap
2. Create the tcp_packets chain in example_table:

   # nft add chain inet example_table tcp_packets

   Copy to Clipboard Toggle word wrap
3. Add a rule to tcp_packets that counts the traffic in this chain:

   # nft add rule inet example_table tcp_packets counter

   Copy to Clipboard Toggle word wrap
4. Create the udp_packets chain in example_table:

   # nft add chain inet example_table udp_packets

   Copy to Clipboard Toggle word wrap
5. Add a rule to udp_packets that counts the traffic in this chain:

   # nft add rule inet example_table udp_packets counter

   Copy to Clipboard Toggle word wrap
6. Create a chain for incoming traffic. For example, to create a chain named incoming_traffic in example_table that filters incoming traffic:

   # nft add chain inet example_table incoming_traffic { type filter hook input priority 0 \; }

   Copy to Clipboard Toggle word wrap
7. Add a rule with an anonymous map to incoming_traffic:

   # nft add rule inet example_table incoming_traffic ip protocol vmap { tcp : jump tcp_packets, udp : jump udp_packets }

   Copy to Clipboard Toggle word wrap
   The anonymous map distinguishes the packets and sends them to the different counter chains based on their protocol.
8. To list the traffic counters, display example_table:

   # nft list table inet example_table
   table inet example_table {
     chain tcp_packets {
       counter packets 36379 bytes 2103816
     }
   
     chain udp_packets {
       counter packets 10 bytes 1559
     }
   
     chain incoming_traffic {
       type filter hook input priority filter; policy accept;
       ip protocol vmap { tcp : jump tcp_packets, udp : jump udp_packets }
     }
   }
   

   Copy to Clipboard Toggle word wrap
   The counters in the tcp_packets and udp_packets chain display both the number of received packets and bytes.

Procedure 6.16. Using named maps in nftables

1. Create a table. For example, to create a table named example_table that processes IPv4 packets:

   # nft add table ip example_table

   Copy to Clipboard Toggle word wrap
2. Create a chain. For example, to create a chain named example_chain in example_table:

   # nft add chain ip example_table example_chain { type filter hook input priority 0 \; }

   Copy to Clipboard Toggle word wrap

   Important

   To avoid that the shell interprets the semicolons as the end of the command, you must escape the semicolons with a backslash.
3. Create an empty map. For example, to create a map for IPv4 addresses:

   # nft add map ip example_table example_map { type ipv4_addr : verdict \; }

   Copy to Clipboard Toggle word wrap
4. Create rules that use the map. For example, the following command adds a rule to example_chain in example_table that applies actions to IPv4 addresses which are both defined in example_map:

   # nft add rule example_table example_chain ip saddr vmap @example_map

   Copy to Clipboard Toggle word wrap
5. Add IPv4 addresses and corresponding actions to example_map:

   # nft add element ip example_table example_map { 192.0.2.1 : accept, 192.0.2.2 : drop }

   Copy to Clipboard Toggle word wrap
   This example defines the mappings of IPv4 addresses to actions. In combination with the rule created above, the firewall accepts packet from 192.0.2.1 and drops packets from 192.0.2.2.
6. Optionally, enhance the map by adding another IP address and action statement:

   # nft add element ip example_table example_map { 192.0.2.3 : accept }

   Copy to Clipboard Toggle word wrap
7. Optionally, remove an entry from the map:

   # nft delete element ip example_table example_map { 192.0.2.1 }

   Copy to Clipboard Toggle word wrap
8. Optionally, display the rule set:

   # nft list ruleset
   table ip example_table {
     map example_map {
       type ipv4_addr : verdict
       elements = { 192.0.2.2 : drop, 192.0.2.3 : accept }
     }
   
     chain example_chain {
       type filter hook input priority filter; policy accept;
       ip saddr vmap @example_map
     }
   }
   

   Copy to Clipboard Toggle word wrap