From nftables wiki
Revision as of 12:08, 1 February 2018 by Arturo (talk | contribs) (Examples: add ipset types)
Jump to: navigation, search

Since Linux kernel 4.1, nftables supports concatenations.

This new feature allows you to put two or more selectors together to perform very fast lookups by combining them with sets, dictionaries and maps.

Literal sets

% nft add rule ip filter input ip saddr . ip daddr . ip protocol { . . tcp, . . udp} counter accept

So if the packet is source IP address AND destination IP address AND TCP destination port match:

  • and and TCP.


  • and and UDP.

nftables updates the counter for this rule and then accepts the packet.

Dictionary declarations

The following example creates the whitelist dictionary using a concatenation of two selectors:

% nft add map filter whitelist { type ipv4_addr . inet_service : verdict \; }

Once you create the dictionary, you can use it from a rule that creates the following concatenation:

% nft add rule filter input ip saddr . tcp dport vmap @whitelist

Thus, the rule above looks up for a verdict based on the source IP address AND the TCP destination port.

Since the dictionary is initially empty, you can dynamically populate this dictionary with elements through:

% nft add element filter whitelist { . 22 : accept}

Literal maps

The rule below determines the destination IP address that is used to perform DNAT to the packet based on:

  • the source IP address


  • the destination TCP port
% nft add rule ip nat prerouting dnat ip saddr . tcp dport map { . 80 :, . 8888 : }


Some concrete example concatenations so you get an idea on how powerful this new feature is.

Network addresses

The example below implements a dictionary using network masks as matching element.

% nft add rule tablename chainname ip saddr and . ip daddr and vmap { . : accept }

Note that this is not an interval, this is masking the ip saddr and ip daddr, then concate both results. This concatenation is used to lookup for a matching of this the result in the map. This syntax may be compacted in future releases to support CIDR notation.

This could be easily implemented using a named map as well:

% nft add map tablename myMap { type ipv4_addr . ipv4_addr : verdict \; }
% nft add rule tablename chainname ip saddr and . ip saddr and vmap @myMap
% nft add element tablename myMap { . : accept }


The example below checks both input and output interfaces of a forwarded packet.

% nft add rule tablename chainname iif . oif vmap { eth0 . eth1 : accept }

Please note that using strings (for example iifname and oifname) and other variable sized data types is not supported yet.

Some ipset types

These ipset types can be implemented in nftables using concatenations. Probably more equivalences exists, it just a matter of combining data types. Of course, you could implement these as named maps/sets as well.


% nft add rule tablename chainname ip saddr and . ip daddr and vmap { . : accept }


% nft add rule tablename chainname ip saddr and . tcp dport . ip daddr and vmap { . 80 . : accept }


% nft add rule tablename chainname ip saddr and . iif vmap { . eth0 : accept }