Nftables/Examples

On this page several example nftable configurations can be found. The first two examples are skeletons to illustrate how nftables works. The third and fourth exmaple show how, using nftables, rules can be simplified by combining IPv4 and IPv6 in the generic IP table 'inet'. The fifth example shows how nftables can be combined with bash scripting.

Basic routing firewall
The following is an example of nftables rules for a basic IPv4 firewall that: 1) only allows packets from lan to the firewall machine and 2) only allows packets a) from lan to wan and b) from wan to lan for connections established by lan.

Please note: for forwarding between wan and lan to work, it needs to be enabled with sysctl or in /proc/sys.

Basic NAT
The following is an example of nftables rules for setting up basic Network Address Translation (NAT) using masquerade. If you have a static IP, it would be slightly faster to use source nat (SNAT) instead of masquerade. This way the router would replace the source with a predefined IP, instead of looking up the outgoing IP for every packet.

Typical workstation (separate IPv4 and IPv6)
This is an example of a simple rule set that may be used by a typical workstation or other end user device. It defaults to dropping packets that do not match any of the rules, uses connection tracking to accept packets established or related to traffic initiated by the host, and accepts all ICMP (see note). Further, it assumes that you want to be able to connect to the machine via SSH.

While is used in this example, it isn't required if you're not interested in packet counts. Just omit from any rule.

Typical workstation (combined IPv4 and IPv6)
As for the previous example, but uses the family to apply rules to both IPv4 and IPv6 packets. So, only one table needs to be maintained.

Stateful router example
The following is an example of nftables configuration script for a stateful router.