Nftables.conf config example 22.10.25

cat /etc/nftables.conf
a starter nftables config file what allows only 3 input/inbound ports
* 22
* 5984
* 8529
```
#!/usr/sbin/nft -f

flush ruleset

table inet filter {
	chain input {
		type filter hook input priority filter; policy drop;
                ct state established,related accept;		
                iifname lo accept;
                ip protocol icmp accept;
                ip6 nexthdr icmpv6 accept;
                tcp dport {22,5984,8529} ct state new accept;
                reject with icmp type port-unreachable;
	}
	chain forward {
		type filter hook forward priority filter; policy drop;
	}
	chain output {
		type filter hook output priority filter; policy accept;
	}
}
```

default ruleset allows everything by default.

In order to actually block all the connections, you need to add policy drop; after each respective type filter ... line. Semicolons are optional if you put each rule on its own line.

A much compact ruleset is really ill-advised. At the very least you need to allow loopback connections 'cause otherwise many programs will fail to work in mysterious ways:

For input, iif lo accept and for output oif lo accept.

And allowing established connections for all the chains is necessary: ct state established,related accept - this rule is the same for every chain.

https://unix.stackexchange.com/questions/772011/does-nftables-allow-port-22-or-other-ports-by-default

Anonymous

22.10.25

Anonymous

22.10.25

https://www.youtube.com/watch?v=_A-Q6yTMX0g

Anonymous

Nftables.conf config example 22.10.25

Information Epoch 1761522711