文件操作 - overview.nft

文件: /usr/share/doc/nftables/examples/overview.nft

#!/usr/sbin/nft -f

table inet overview_test_table {
	chain overview_test_chain {
		#
		# simple selectors
		#

# source & destination address
		ip saddr 1.1.1.1 ip daddr 2.2.2.2

# tcp or udp ports
		tcp dport 123
		udp sport 123

# using sets
		ip saddr {1.1.1.1, 2.2.2.2} ip daddr {3.3.3.3, 4.4.4.4} tcp dport {22, 80, 443}

# packets meta information: nic names
		iifname eth0 oifname eth1

# packets meta information: nic index
		iif bond0 oif bond1

# conntrack engine states
		ct state new,established
		ct state invalid
		ct state established,related

#
		# simple verdicts (iptables targets)
		#

# counter and drop all traffic
		counter drop

# accept all traffic
		accept

#
		# rejecting traffic (more info at http://wiki.nftables.org/)
		#

# counter and reject all traffic
		counter reject

# reject with a concrete ICMP code
		reject with icmp type host-unreachable

# reject with a concrete ICMPv6 code
		reject with icmpv6 type no-route

# multi-family reject, using the icmpx keyword
		reject with icmpx type admin-prohibited
	}
}