Rejecting traffic
Note: Full reject support is available since Linux kernel 3.18.
The following rule shows how to reject any traffic from the network:
% nft add rule filter input reject
If you don't specify any reason, an ICMP/ICMPv6 port unreachable packet is sent to the origin.
You can narrow down this through the ct selector, so this only rejects traffic coming to the local machine which was not originated from us.
% nft add rule filter input ct state new reject
You can also specify the reject reason. For example:
% nft add rule filter input reject with icmp type host-unreachable
For ICMP, you can use the following reject reasons:
- net-unreachable: Destination network unreachable
- host-unreachable: Destination host unreachable
- prot-unreachable: Destination protocol unreachable
- port-unreachable: Destination port unreachable (this is the default)
- net-prohibited: Network administratively prohibited
- host-prohibited: Host administratively prohibited
- admin-prohibited: Communication administratively prohibited
You can also reject IPv6 traffic indicating the reject reason, for example:
% nft add rule ip6 filter input reject with icmpv6 type no-route
For ICMPv6, you can use the following reasons:
- no-route: No route to destination.
- admin-prohibited: Communication with destination administratively prohibited
- addr-unreachable: Address unreachable
- port-unreachable: Port unreachable
From the inet family, you can use an abstraction, the so-called icmpx, to reject the IPv4 and IPv6 traffic using one single rule. For example:
% nft add rule inet filter input reject with icmpx type no-route
This rule rejects IPv4 traffic with the reason "net unreachable" and the IPv6 traffic with the reason "no route". The mapping is shown in the following table:
| ICMPX REASON | ICMPv6 | ICMPv4 |
| admin-prohibited | admin-prohibited | admin-prohibited |
| port-unreachable | port-unreachable | port-unreachable |
| no-route | no-route | net-unreachable |
| host-unreachable | addr-unreachable | host-unreachable |