表达式
- accept、drop、queue、continue、return、jump chain、goto chain
- masquerade - 源地址自动设置为出口地址
- type
- filter、route、nat
family | - |
---|---|
ip | IPv4 - 默认 |
ip6 | IPv6 |
inet | IPv4/IPv6 |
arp | IPv4 ARP |
bridge | 经过桥接设备的包 |
netdev | 入口设备 |
[地址类型]
hook | desc |
---|---|
prerouting | 所有进入系统的包,在路由之前处理,可用于过滤和修改属性 |
input | 进入 本地 系统的包 |
forward | 转发到其他 host 的包 |
output | 本地 发出的包 |
postrouting | 所有离开系统的包 |
ingress | 所有进入系统的包, L3 之前,早于 prerouting,只能用于 inet |
[Hook 类型]
- 地址 支持的 hook
- ip,ip6,inet,bridge - prerouting,input,forward,output,postrouting
- arp - input,output
- netdav - ingress
优先级
PRI | name | def | desc |
---|---|---|---|
-400 | NF_IP_PRI_CONNTRACK_DEFRAG | priority of defragmentation | |
-300 | raw | NF_IP_PRI_RAW | traditional priority of the raw table placed before connection tracking operation |
-225 | NF_IP_PRI_SELINUX_FIRST | SELinux operations | |
-200 | NF_IP_PRI_CONNTRACK | Connection tracking operations | |
-150 | mangle | NF_IP_PRI_MANGLE | mangle operation |
-100 | dstnat | NF_IP_PRI_NAT_DST | DNAT |
0 | filter | NF_IP_PRI_FILTER | filtering operation, the filter table |
50 | security | NF_IP_PRI_SECURITY | Place of security table where secmark can be set for example |
100 | srcnat | NF_IP_PRI_NAT_SRC | SNAT |
225 | NF_IP_PRI_SELINUX_LAST | SELinux at packet exit | |
300 | NF_IP_PRI_CONNTRACK_HELPER | connection tracking at exit |
bridge 优先级
| Name | Value | Hooks | | ------ | -------------- | ----------- | | dstnat | -300 | prerouting | | filter | -200 | all | | out | 100 | output | | srcnat | 300 | postrouting |
匹配
- meta (元属性,如接口)
- oif、iif、oifname、iifname
- icmp (ICMP 协议)
- type
- icmpv6 (ICMPv6 协议)
- type
- ip (IP 协议)
- protocol
- daddr
- saddr
- ip6 (IPv6 协议)
- daddr
- saddr
- tcp (TCP 协议)
- dport
- sport
- udp (UDP 协议)
- dport
- sport
- sctp (SCTP 协议)
- dport
- sport
- ct (链接跟踪)
- state new | established | related | invalid
# 查看端口
nft describe tcp dport
nft
\
续行#
注释- 标识符
^[a-zA-Z][a-zA-Z0-9/\_.]*
- 可使用双引号避免冲突
- nft.8
# 引入文件
# -I/--includepath
# 忽略 . 开头文件
include filename
# 定义变量
define variable = expr
# 使用变量
$variable