NFTables

# 所有规则
nft list ruleset
# 导出为 JSON
nft -j list ruleset

# 清除规则
nft flush ruleset

# 清除单个 famliy 规则
nft flush ruleset arp
nft flush ruleset ip
nft flush ruleset ip6
nft flush ruleset bridge
nft flush ruleset inet

nft -c -f rule.nft # 检查规则
nft -f rule.nft    # 应用规则

# 转义
# nft add rule ip filter INPUT tcp dport 22 ct state new counter accept
iptables-translate -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT

# 单个规则只能使用句柄删除
# 查看
nft --handle --numeric list chain inet filter input
# 删除
nft delete rule inet fltrTable input handle 10

# 清空表
nft flush table foo
# 清空链
nft flush chain foo bar
nft delete rule ip6 foo bar

nft describe tcp flags
nft describe ct_state
nft describe icmp_type

table ip nat {
    chain prerouting {
        type nat hook prerouting priority 0;
    }
    chain postrouting {
        type nat hook postrouting priority 100;
        oif "eth5" masquerade
    }
}

table ip filter {
    chain input {
        type filter hook input priority 0;

        # 限制从 eth5 进来的流量只能访问特定端口
        iifname "eth5" tcp dport { 22, 80, 443 } accept
        iifname "eth5" udp dport { 22, 80, 443 } accept

        # 允许来自 192.168.0.0/16 的所有流量
        ip saddr 192.168.0.0/16 accept
    }
    chain forward {
        type filter hook forward priority 0;
        policy drop;

        # 不转发到 192.168.66.2 的流量
        ip daddr 192.168.66.2 drop;

        # 允许来自 eth0 并且源地址为 192.168.0.0/16 的所有流量
        ip saddr 192.168.0.0/16 iifname "eth0" oifname "eth5" accept;

        # 允许从 eth5 到 eth0 的已建立连接的回应流量
        iifname "eth5" oifname "eth0" ct state established accept;
    }
    chain output {
        type filter hook output priority 0;
    }
}