I'm building a new server, and thought, its 2025 and probably good time to migrate from iptables, ipset... to nftables. earlier or later it has to happen any way, right?
# uname -a
Linux starnet 6.12.6-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.6-1 (2024-12-21) x86_64 GNU/Linux
# nft -V
nftables v1.1.1 (Commodore Bullmoose #2)
cli: editline
json: yes
minigmp: no
libxtables: yes
Started with simple commands, and already started to strugle. Later came to need of using sets of ips. Oh man, nftables is hell of a nightmare... Ok, to the problem:
simple bash script to create ip set:
#!/bin/bash
NFT=/usr/sbin/nft
$NFT add set inet filter ALLOWIPS { type ipv4_addr \; flags constant, interval \; }.
$NFT flush set inet filter ALLOWIPS
$NFT add element inet filter ALLOWIPS { 172.17.0.0/24 }
$NFT add element inet filter ALLOWIPS { 192.168.0.0/24 }
$NFT add element inet filter ALLOWIPS { 192.168.1.58 }
$NFT add element inet filter ALLOWIPS { 192.168.1.89 }
$NFT add element inet filter ALLOWIPS { 192.168.1.125 }
$NFT add element inet filter ALLOWIPS { 192.168.1.179 }
$NFT add element inet filter ALLOWIPS { 192.168.1.212 }
see if worked:
# nft list set inet filter ALLOWIPS
table inet filter {
set ALLOWIPS {
type ipv4_addr
flags constant,interval
elements = { 172.17.0.0/24, 192.168.0.0/24,
192.168.1.58, 192.168.1.89,
192.168.1.125, 192.168.1.179,
192.168.1.212 }
}
}
try some management:
# nft delete element inet filter ALLOWIPS { 192.168.1.58 }
# nft list set inet filter ALLOWIPS
table inet filter {
set ALLOWIPS {
type ipv4_addr
flags constant,interval
elements = { 172.17.0.0/24, 192.168.0.0/24,
192.168.1.89, 192.168.1.125,
192.168.1.179, 192.168.1.212 }
}
}
now, try using this ip set
# nft add rule inet filter input iifname int1 ip daddr 8.8.8.8 ip saddr @ALLOWIPS accept
and here I stopped:
# nft add element inet filter ALLOWIPS { 192.168.1.58 }
Error: Could not process rule: Device or resource busy
add element inet filter ALLOWIPS { 192.168.1.58 }
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
# nft flush set inet filter ALLOWIPS
Error: Could not process rule: Device or resource busy
flush set inet filter ALLOWIPS
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
https://wiki.nftables.org/wiki-nftables/index.php/Sets says: "Named sets can be updated anytime."
Please help me nft gods Thanks.
flags constantprohibits changes when the rule is in use.