Sets - Revision history

Arturo: /* Named sets specifications */ mention auto-merge

2023-09-15T10:48:56Z

Named sets specifications: mention auto-merge

@@ Line 175: / Line 175: @@
+	}
+}
 </source>

Fmyhr: /* Named sets */ Add optional set comment attribute, with nft and kernel requirements.

2021-11-01T17:26:06Z

Named sets: Add optional set comment attribute, with nft and kernel requirements.

← Older revision		Revision as of 17:26, 1 November 2021
Line 41:		Line 41:

	<source lang="bash">		<source lang="bash">
	% nft add set ip filter blackhole { type ipv4_addr\;}		% nft add set ip filter blackhole { type ipv4_addr\; comment \"drop all packets from these hosts\" \; }
	</source>		</source>

	creates a set named ''blackhole''. Set names must be 16 characters or less. The ''type'' keyword indicates the data type of elements to be stored in the set. In this case ''blackhole'' stores IPv4 addresses, which you can add using ''nft add element'':		creates a set named ''blackhole''. Set names must be 16 characters or less. The optional set ''comment'' attribute requires at least nftables 0.9.7 and kernel 5.10. The ''type'' keyword indicates the data type of elements to be stored in the set. In this case ''blackhole'' stores IPv4 addresses, which you can add using ''nft add element'':

	<source lang="bash">		<source lang="bash">

Pablo: add query for element s in a set

2021-09-03T22:51:19Z

add query for element s in a set

← Older revision		Revision as of 22:51, 3 September 2021
Line 184:		Line 184:
	% nft list set ip filter myset		% nft list set ip filter myset
	</source>		</source>

			= Query for element membership in a set =

			You can also check if an element exists in the set from its key:

			<source lang="bash">
			% nft get element ip filter myset { 1.1.1.1 }
			</source>

			The example above checks if the IPv4 address 1.1.1.1 exists in the ''myset'' set.

Fmyhr: /* Named sets */ Edited for clarity, added example of negating set match.

2021-02-15T22:23:26Z

Named sets: Edited for clarity, added example of negating set match.

← Older revision		Revision as of 22:23, 15 February 2021
Line 38:		Line 38:
	= Named sets =		= Named sets =

	You can create ~~the~~ named ~~sets with the following command~~:		You can use ''nft add set'' to create a named set. For example:

	<source lang="bash">		<source lang="bash">
Line 44:		Line 44:
	</source>		</source>

	~~Note that~~ ''blackhole'' ~~is the name of the set in this case~~. The ''type'' ~~option~~ indicates the data type ~~that~~ this ~~set~~ stores, which ~~is an IPv4 address in this case. Current maximum name length is 16 characters.~~		creates a set named ''blackhole''. Set names must be 16 characters or less. The ''type'' keyword indicates the data type of elements to be stored in the set. In this case ''blackhole'' stores IPv4 addresses, which you can add using ''nft add element'':

	<source lang="bash">		<source lang="bash">
Line 51:		Line 51:
	</source>		</source>

	~~Then, you~~ can use it from ~~the rule~~:		You can use named sets from rules, as for example:

	<source lang="bash">		<source lang="bash">
	% nft add rule ip filter input ip saddr @blackhole drop		% nft add rule ip filter input ip saddr @blackhole drop
			% nft add rule ip filter output ip daddr != @blackhole accept
	</source>		</source>

	Named sets can be updated anytime~~, so you can add and delete element from them~~.		Named sets can be updated anytime.

	== nftables.conf syntax ==		== nftables.conf syntax ==
Line 89:		Line 90:
	udp dport { http, https } ip saddr $CDN accept		udp dport { http, https } ip saddr $CDN accept
	</source>		</source>


	= Named sets specifications =		= Named sets specifications =

Fmyhr: dictionaries -> verdict maps

2021-02-12T10:52:04Z

dictionaries -> verdict maps

← Older revision		Revision as of 10:52, 12 February 2021
Line 1:		Line 1:
	''nftables'' comes with a built-in generic set infrastructure that allows you to use '''any''' supported selector to build sets. This infrastructure makes possible the representation of [[~~dictionaries~~]] and [[maps]].		''nftables'' comes with a built-in generic set infrastructure that allows you to use '''any''' supported selector to build sets. This infrastructure makes possible the representation of [[maps]] and [[Verdict_Maps_(vmaps) \| verdict maps]].

	The set elements are internally represented using performance data structures such as hashtables and red-black trees.		The set elements are internally represented using performance data structures such as hashtables and red-black trees.

Arturo: /* Named sets specifications */ add info on counters

2020-09-07T11:00:19Z

Named sets specifications: add info on counters

@@ Line 164: / Line 164: @@
 ** ''performance'' [default]
 ** ''memory''
 = Listing named sets =

Arturo: /* Named sets specifications */ mention typeof

2020-09-07T10:56:33Z

Named sets specifications: mention typeof

@@ Line 95: / Line 95: @@
 Sets specifications are:
-* '''type''', is obligatory and determines the data type of the set elements. Supported data types currently are:
+* '''type''' or '''typeof''', is obligatory and determines the data type of the set elements.
 ** ''ipv4_addr'': IPv4 address
 ** ''ipv6_addr'': IPv6 address.
@@ Line 103: / Line 105: @@
 ** ''mark'': Mark type.
 ** ''ifname'': Network interface name (eth0, eth1..)
 * '''timeout''', it determines how long an element stays in the set. The time string respects the format: ''"v<sub>1</sub>dv<sub>2</sub>hv<sub>3</sub>mv<sub>4</sub>s"'':

Glloyd: Add set syntax and examples for nftables.conf

2020-06-16T17:50:04Z

Add set syntax and examples for nftables.conf

← Older revision		Revision as of 17:50, 16 June 2020
Line 58:		Line 58:

	Named sets can be updated anytime, so you can add and delete element from them.		Named sets can be updated anytime, so you can add and delete element from them.

			== nftables.conf syntax ==

			When working with nftables.conf, you can define sets in a number of ways. You can then reference those sets later on using <code>$VARIABLE_NAME</code> notation.

			Here are some examples showing sets defined in one line, spanning multiple lines, and sets referencing other sets. The set is then used in a rule to allow incoming traffic from certain IP ranges.

			<source lang="bash">
			define SIMPLE_SET = { 192.168.1.1, 192.168.1.2 }

			define CDN_EDGE = {
			192.168.1.1,
			192.168.1.2,
			192.168.1.3,
			10.0.0.0/8
			}

			define CDN_MONITORS = {
			192.168.1.10,
			192.168.1.20
			}

			define CDN = {
			$CDN_EDGE,
			$CDN_MONITORS
			}

			# Allow HTTP(S) from approved IP ranges only
			tcp dport { http, https } ip saddr $CDN accept
			udp dport { http, https } ip saddr $CDN accept
			</source>


	= Named sets specifications =		= Named sets specifications =

Arturo: /* Named sets specifications */ add ifname

2019-11-04T11:41:11Z

Named sets specifications: add ifname

← Older revision		Revision as of 11:41, 4 November 2019
Line 70:		Line 70:
	** ''inet_service'': Internet service (read tcp port for example)		** ''inet_service'': Internet service (read tcp port for example)
	** ''mark'': Mark type.		** ''mark'': Mark type.
			** ''ifname'': Network interface name (eth0, eth1..)

	* '''timeout''', it determines how long an element stays in the set. The time string respects the format: ''"v<sub>1</sub>dv<sub>2</sub>hv<sub>3</sub>mv<sub>4</sub>s"'':		* '''timeout''', it determines how long an element stays in the set. The time string respects the format: ''"v<sub>1</sub>dv<sub>2</sub>hv<sub>3</sub>mv<sub>4</sub>s"'':

Fw: /* Anonymous sets */

2019-10-04T15:29:44Z

Anonymous sets

← Older revision		Revision as of 15:29, 4 October 2019
Line 14:		Line 14:

	<source lang="bash">		<source lang="bash">
	% nft add rule filter output tcp dport { 22, 23 } counter		% nft add rule ip filter output tcp dport { 22, 23 } counter
	</source>		</source>