Quick reference-nftables in 10 minutes - Revision history

Aurelien: /* Rules */ Clarify the explanation about the inserted rule position.

2024-04-21T07:52:41Z

Rules: Clarify the explanation about the inserted rule position.

← Older revision		Revision as of 07:52, 21 April 2024
Line 61:		Line 61:
	</source>		</source>

	~~Inserting a new rule with ''nft insert'' inserts it~~ at the beginning of the chain, by default. However, if you specify a ''position'' handle, then the new rule is inserted just before the rule with that handle.		Inserted rules are placed at the beginning of the chain, by default. However, if you specify a ''position'' handle, then the new rule is inserted just before the existing rule with that handle.

	=== Matches ===		=== Matches ===

Aurelien: /* Rules */ Clarify that is just a handle (not some other type of identifier), and the new rule is inserted just before the rule with that handle.

2024-04-21T07:47:18Z

Rules: Clarify that <position> is just a handle (not some other type of identifier), and the new rule is inserted just before the rule with that handle.

← Older revision		Revision as of 07:47, 21 April 2024
Line 53:		Line 53:

	'''handle''' is an internal number that identifies a certain ''rule''.		'''handle''' is an internal number that identifies a certain ''rule''.

	~~'''position''' is an internal number that is used to insert a ''rule'' before a certain ''handle''.~~

	<source lang="bash">		<source lang="bash">
	% nft add rule [<family>] <table> <chain> <matches> <statements>		% nft add rule [<family>] <table> <chain> <matches> <statements>
	% nft insert rule [<family>] <table> <chain> [position <~~position~~>] <matches> <statements>		% nft insert rule [<family>] <table> <chain> [position <handle>] <matches> <statements>
	% nft replace rule [<family>] <table> <chain> [handle <handle>] <matches> <statements>		% nft replace rule [<family>] <table> <chain> [handle <handle>] <matches> <statements>
	% nft delete rule [<family>] <table> <chain> [handle <handle>]		% nft delete rule [<family>] <table> <chain> [handle <handle>]
	</source>		</source>

			Inserting a new rule with ''nft insert'' inserts it at the beginning of the chain, by default. However, if you specify a ''position'' handle, then the new rule is inserted just before the rule with that handle.

	=== Matches ===		=== Matches ===

Aurelien: More consistent spacing, e.g., { a, b, c } instead of { a,b, c} or {a, b, c }

2024-04-21T06:29:38Z

More consistent spacing, e.g., { a, b, c } instead of { a,b, c} or {a, b, c }

Show changes

Aurelien: /* Comp */ More consistent space after { and before }

2024-04-21T06:22:45Z

Comp: More consistent space after { and before }

← Older revision		Revision as of 06:22, 21 April 2024
Line 595:		Line 595:
	\|<source lang="bash">		\|<source lang="bash">
	comp nexthdr != esp		comp nexthdr != esp
	comp nexthdr {esp, ah, comp, udp, udplite, tcp, tcp, dccp, sctp}		comp nexthdr { esp, ah, comp, udp, udplite, tcp, tcp, dccp, sctp }
	</source>		</source>
	\|-		\|-
Line 603:		Line 603:
	comp flags 0x0		comp flags 0x0
	comp flags != 0x33-0x45		comp flags != 0x33-0x45
	comp flags {0x33, 0x55, 0x67, 0x88}		comp flags { 0x33, 0x55, 0x67, 0x88 }
	</source>		</source>
	\|-		\|-
Line 611:		Line 611:
	comp cpi 22		comp cpi 22
	comp cpi != 33-45		comp cpi != 33-45
	comp cpi {33, 55, 67, 88}		comp cpi { 33, 55, 67, 88 }
	</source>		</source>
	\|}		\|}


	==== Icmp ====		==== Icmp ====

Aurelien: /* Esp */ More consistent space after { and before }

2024-04-21T06:22:19Z

Esp: More consistent space after { and before }

← Older revision		Revision as of 06:22, 21 April 2024
Line 574:		Line 574:
	esp spi 111		esp spi 111
	esp spi != 111-222		esp spi != 111-222
	esp spi {111, 122 }		esp spi { 111, 122 }
	</source>		</source>
	\|-		\|-
Line 581:		Line 581:
	\|<source lang="bash">		\|<source lang="bash">
	esp sequence 123		esp sequence 123
	esp sequence {23, 25, 33}		esp sequence { 23, 25, 33 }
	esp sequence != 23-33		esp sequence != 23-33
	</source>		</source>
	\|}		\|}


	==== Comp ====		==== Comp ====

Aurelien: /* Ah */ More consistent space after { and before }

2024-04-21T06:21:59Z

Ah: More consistent space after { and before }

← Older revision		Revision as of 06:21, 21 April 2024
Line 535:		Line 535:
	ah hdrlength 11-23		ah hdrlength 11-23
	ah hdrlength != 11-23		ah hdrlength != 11-23
	ah hdrlength {11, 23, 44 }		ah hdrlength { 11, 23, 44 }
	</source>		</source>
	\|-		\|-
Line 543:		Line 543:
	ah reserved 22		ah reserved 22
	ah reserved != 33-45		ah reserved != 33-45
	ah reserved {23, 100 }		ah reserved { 23, 100 }
	ah reserved { 33-55 }		ah reserved { 33-55 }
	</source>		</source>
Line 552:		Line 552:
	ah spi 111		ah spi 111
	ah spi != 111-222		ah spi != 111-222
	ah spi {111, 122 }		ah spi { 111, 122 }
	</source>		</source>
	\|-		\|-
Line 559:		Line 559:
	\|<source lang="bash">		\|<source lang="bash">
	ah sequence 123		ah sequence 123
	ah sequence {23, 25, 33}		ah sequence { 23, 25, 33 }
	ah sequence != 23-33		ah sequence != 23-33
	</source>		</source>
	\|}		\|}


	==== Esp ====		==== Esp ====

Aurelien: /* Dccp */ More consistent space after { and before }

2024-04-21T06:21:26Z

Dccp: More consistent space after { and before }

← Older revision		Revision as of 06:21, 21 April 2024
Line 500:		Line 500:
	dccp dport != 33-45		dccp dport != 33-45
	dccp dport { 33-55 }		dccp dport { 33-55 }
	dccp dport {telnet, http, https }		dccp dport { telnet, http, https }
	dccp dport vmap { 22 : accept, 23 : drop }		dccp dport vmap { 22 : accept, 23 : drop }
	dccp dport vmap { 25:accept, 28:drop }		dccp dport vmap { 25:accept, 28:drop }
Line 510:		Line 510:
	dccp sport 22		dccp sport 22
	dccp sport != 33-45		dccp sport != 33-45
	dccp sport { 33, 55, 67, 88}		dccp sport { 33, 55, 67, 88 }
	dccp sport { 33-55}		dccp sport { 33-55 }
	dccp sport vmap { 25:accept, 28:drop }		dccp sport vmap { 25:accept, 28:drop }
	dccp sport 1024 dccp dport 22		dccp sport 1024 dccp dport 22
Line 519:		Line 519:
	\| Type of packet		\| Type of packet
	\|<source lang="bash">		\|<source lang="bash">
	dccp type {request, response, data, ack, dataack, closereq, close, reset, sync, syncack}		dccp type { request, response, data, ack, dataack, closereq, close, reset, sync, syncack }
	dccp type request		dccp type request
	dccp type != request		dccp type != request
	</source>		</source>
	\|}		\|}


	==== Ah ====		==== Ah ====

Aurelien: /* Sctp */ More consistent space after { and before }

2024-04-21T06:20:58Z

Sctp: More consistent space after { and before }

← Older revision		Revision as of 06:20, 21 April 2024
Line 440:		Line 440:
	sctp dport != 33-45		sctp dport != 33-45
	sctp dport { 33-55 }		sctp dport { 33-55 }
	sctp dport {telnet, http, https }		sctp dport { telnet, http, https }
	sctp dport vmap { 22 : accept, 23 : drop }		sctp dport vmap { 22 : accept, 23 : drop }
	sctp dport vmap { 25:accept, 28:drop }		sctp dport vmap { 25:accept, 28:drop }
Line 450:		Line 450:
	sctp sport 22		sctp sport 22
	sctp sport != 33-45		sctp sport != 33-45
	sctp sport { 33, 55, 67, 88}		sctp sport { 33, 55, 67, 88 }
	sctp sport { 33-55}		sctp sport { 33-55 }
	sctp sport vmap { 25:accept, 28:drop }		sctp sport vmap { 25:accept, 28:drop }
	sctp sport 1024 sctp dport 22		sctp sport 1024 sctp dport 22

Aurelien: /* Udplite */ More consistent space after { and before }

2024-04-21T06:20:26Z

Udplite: More consistent space after { and before }

← Older revision		Revision as of 06:20, 21 April 2024
Line 403:		Line 403:
	udplite dport != 33-45		udplite dport != 33-45
	udplite dport { 33-55 }		udplite dport { 33-55 }
	udplite dport {telnet, http, https }		udplite dport { telnet, http, https }
	udplite dport vmap { 22 : accept, 23 : drop }		udplite dport vmap { 22 : accept, 23 : drop }
	udplite dport vmap { 25:accept, 28:drop }		udplite dport vmap { 25:accept, 28:drop }
Line 413:		Line 413:
	udplite sport 22		udplite sport 22
	udplite sport != 33-45		udplite sport != 33-45
	udplite sport { 33, 55, 67, 88}		udplite sport { 33, 55, 67, 88 }
	udplite sport { 33-55}		udplite sport { 33-55 }
	udplite sport vmap { 25:accept, 28:drop }		udplite sport vmap { 25:accept, 28:drop }
	udplite sport 1024 udplite dport 22		udplite sport 1024 udplite dport 22
Line 428:		Line 428:
	</source>		</source>
	\|}		\|}


	==== Sctp ====		==== Sctp ====

Aurelien: /* Udp */ More consistent space after { and before }

2024-04-21T06:19:52Z

Udp: More consistent space after { and before }

← Older revision		Revision as of 06:19, 21 April 2024
Line 357:		Line 357:
	udp dport != 33-45		udp dport != 33-45
	udp dport { 33-55 }		udp dport { 33-55 }
	udp dport {telnet, http, https }		udp dport { telnet, http, https }
	udp dport vmap { 22 : accept, 23 : drop }		udp dport vmap { 22 : accept, 23 : drop }
	udp dport vmap { 25:accept, 28:drop }		udp dport vmap { 25:accept, 28:drop }
Line 367:		Line 367:
	udp sport 22		udp sport 22
	udp sport != 33-45		udp sport != 33-45
	udp sport { 33, 55, 67, 88}		udp sport { 33, 55, 67, 88 }
	udp sport { 33-55}		udp sport { 33-55 }
	udp sport vmap { 25:accept, 28:drop }		udp sport vmap { 25:accept, 28:drop }
	udp sport 1024 udp dport 22		udp sport 1024 udp dport 22
Line 391:		Line 391:
	</source>		</source>
	\|}		\|}


	==== Udplite ====		==== Udplite ====