#!/usr/sbin/nft -f table inet overview_test_table { chain overview_test_chain { # # simple selectors # # source & destination address ip saddr 1.1.1.1 ip daddr 2.2.2.2 # tcp or udp ports tcp dport 123 udp sport 123 # using sets ip saddr {1.1.1.1, 2.2.2.2} ip daddr {3.3.3.3, 4.4.4.4} tcp dport {22, 80, 443} # packets meta information: nic names iifname eth0 oifname eth1 # packets meta information: nic index iif bond0 oif bond1 # conntrack engine states ct state new,established ct state invalid ct state established,related # # simple verdicts (iptables targets) # # counter and drop all traffic counter drop # accept all traffic accept # # rejecting traffic (more info at http://wiki.nftables.org/) # # counter and reject all traffic counter reject # reject with a concrete ICMP code reject with icmp type host-unreachable # reject with a concrete ICMPv6 code reject with icmpv6 type no-route # multi-family reject, using the icmpx keyword reject with icmpx type admin-prohibited } }