Accepting and dropping packets - Revision history

Pablo: Created page with "= Dropping packets = You can use the ''drop'' option to drop packets. Note that drop is a '''terminating''' action, so you cannot add any other action after it.
2016-07-13T17:45:33Z

Created page with "= Dropping packets = You can use the ''drop'' option to drop packets. Note that drop is a '''terminating''' action, so you cannot add any other action after it. <source lang..."

New page
= Dropping packets =

You can use the ''drop'' option to drop packets. Note that drop is a '''terminating''' action, so you cannot add any other action after it.

<source lang="bash">
nft add rule filter output drop
</source>

Beware when testing this, you'll likely lose any Internet connectivity :-).

= Accepting packets =

A simple rule to accept any sort of traffic is:

<source lang="bash">
nft add rule filter output accept
</source>

You can add counters to that rule:

<source lang="bash">
nft add rule filter output counter accept
</source>

So you can watch that all traffic is actually accepted:

<source lang="bash">
nft list table filter
table ip filter {
chain output {
type filter hook output priority 0;
counter packets 1 bytes 84 accept
}
}
</source>