nftables

https://www.netfilter.org/projects/nftables/
Admin
nftables is a modern packet filtering framework that replaces iptables, providing a network-specific...
Tokens:45,650
Snippets:350
Trust Score:9.9
Update:2 weeks ago
Show doc for...
Tokens:
Raw
### hash load-balancing examples

Source: https://www.netfilter.org/projects/nftables/manpage.html

Example rules using jhash and symhash for load-balancing. The first uses jhash on source IP; the second uses symhash for symmetric load balancing.

```nft
# load balance based on source ip between 2 ip addresses:
add rule nat prerouting dnat to jhash ip saddr mod 2 map \
        { 0 : 192.168.10.100, 1 : 192.168.20.200 }

# symmetric load balancing between 2 ip addresses:
add rule nat prerouting dnat to symhash mod 2 map \
        { 0 : 192.168.10.100, 1 : 192.168.20.200 }
```

--------------------------------

### tproxy with logging and meta mark example

Source: https://www.netfilter.org/projects/nftables/manpage.html

Example ruleset for tproxy with logging and meta mark. The goto block attempts tproxy and logs success or failure, setting a mark for policy routing.

```nftables
table inet x {
    chain y {
        type filter hook prerouting priority mangle; policy accept;
        udp dport 9999 goto {
            tproxy to :1234 log prefix "packet tproxied: " meta mark set 1 accept
            log prefix "no socket on port 1234 or not transparent?: " drop
        }
    }
}
```

--------------------------------

### numgen load-balancing examples

Source: https://www.netfilter.org/projects/nftables/manpage.html

Example rules using numgen for load-balancing. The first uses 'inc' mode for round-robin between two addresses; the second uses 'random' mode with intervals to create a probability-based bias.

```nft
# round-robin between 192.168.10.100 and 192.168.20.200:
add rule nat prerouting dnat to numgen inc mod 2 map \
        { 0 : 192.168.10.100, 1 : 192.168.20.200 }

# probability-based with odd bias using intervals:
add rule nat prerouting dnat to numgen random mod 10 map \
        { 0-2 : 192.168.10.100, 3-9 : 192.168.20.200 }
```

--------------------------------

### NAT statement usage examples

Source: https://www.netfilter.org/projects/nftables/manpage.html

Example rules for using NAT statements. The first three commands set up the required nat table and prerouting/postrouting chains. The subsequent rules demonstrate snat, dnat, masquerade, and redirect with various options. For the inet family, dnat and snat require the ip or ip6 keyword when an address is provided.

```nftables
# create a suitable table/chain setup for all further examples
add table nat
add chain nat prerouting { type nat hook prerouting priority dstnat; }
add chain nat postrouting { type nat hook postrouting priority srcnat; }

# translate source addresses of all packets leaving via eth0 to address 1.2.3.4
add rule nat postrouting oif eth0 snat to 1.2.3.4

# redirect all traffic entering via eth0 to destination address 192.168.1.120
add rule nat prerouting iif eth0 dnat to 192.168.1.120

# translate source addresses of all packets leaving via eth0 to whatever
# locally generated packets would use as source to reach the same destination
add rule nat postrouting oif eth0 masquerade

# redirect incoming TCP traffic for port 22 to port 2222
add rule nat prerouting tcp dport 22 redirect to :2222

# inet family:
# handle ip dnat:
add rule inet nat prerouting dnat ip to 10.0.2.99
# handle ip6 dnat:
add rule inet nat prerouting dnat ip6 to fe80::dead
# this masquerades both ipv4 and ipv6:
add rule inet nat postrouting meta oif ppp0 masquerade
```

--------------------------------

### vmap statement example

Source: https://www.netfilter.org/projects/nftables/manpage.html

Uses the vmap statement to jump to different chains based on the layer 4 protocol type (tcp, udp, icmp).

```nft
# jump to different chains depending on layer 4 protocol type:
nft add rule ip filter input ip protocol vmap { tcp : jump tcp-chain, udp : jump udp-chain , icmp : jump icmp-chain }
```

--------------------------------

### Example: nft describe tcp flags

Source: https://www.netfilter.org/projects/nftables/manpage.html

Output of the describe command for the tcp flags expression, listing the datatype and predefined symbolic constants.

```bash
$ nft describe tcp flags
payload expression, datatype tcp_flag (TCP flag) (basetype bitmask, integer), 8 bits

predefined symbolic constants:
fin                           0x01
syn                           0x02
rst                           0x04
psh                           0x08
ack                           0x10
urg                           0x20
ecn                           0x40
cwr                           0x80
```

--------------------------------

### String specification for interface names

Source: https://www.netfilter.org/projects/nftables/manpage.html

Examples of specifying interface names in nftables rules, including a normal name and a quoted name for unusual characters.

```nftables
# Interface name
filter input iifname eth0

# Weird interface name
filter input iifname "(eth0)"
```

--------------------------------

### nft element command syntax

Source: https://www.netfilter.org/projects/nftables/manpage.html

Syntax for element-related commands in nftables. Use **add** to add elements, **create** to add only if none already exist, **delete** to remove, **destroy** to remove without failing if absent, **get** to check membership (returns containing interval for interval sets), and **reset** to reset attached state like counters and quotas. Options include timeout, expires, and comment.

```nft
{**add** | **create** | **delete** | **destroy** | **get** | **reset** } **element** [_family_] _table_ _set_ **{** _ELEMENT_[**,** ...] **}**

_ELEMENT_ := _key_expression_ _OPTIONS_ [**:** _value_expression_]
_OPTIONS_ := [**timeout** _TIMESPEC_] [**expires** _TIMESPEC_] [**comment** _string_]
_TIMESPEC_ := [_num_**d**][_num_**h**][_num_**m**][_num_[**s**]]
```

--------------------------------

### List all active netfilter hooks in inet family

Source: https://www.netfilter.org/projects/nftables/manpage.html

Example output of `nft list hooks inet` showing active hooks for the ip family. The priority value determines the order hooks are called, with lower numbers run first. Requires CONFIG_NETFILTER_NETLINK_HOOK enabled.

```nft
% nft list hooks inet
family ip {
        hook prerouting {
                -0000000400 ipv4_conntrack_defrag [nf_defrag_ipv4]
                -0000000200 ipv4_conntrack_in [nf_conntrack]
                -0000000100 nf_nat_ipv4_pre_routing [nf_nat]
        }
        hook input {
                 0000000000 chain inet filter input [nf_tables]
                +0000000100 nf_nat_ipv4_local_in [nf_nat]
[..]
```

--------------------------------

### Example rulesets for tproxy statement

Source: https://www.netfilter.org/projects/nftables/manpage.html

Example rulesets for the tproxy statement in ip, ip6, and inet tables. The tproxy statement is non-terminal, allowing post-processing of packets such as logging and mark updates.

```nftables
table ip x {
    chain y {
        type filter hook prerouting priority mangle; policy accept;
        tcp dport ntp tproxy to 1.1.1.1 accept
        udp dport ssh tproxy to :2222 accept
    }
}
table ip6 x {
    chain y {
       type filter hook prerouting priority mangle; policy accept;
       tcp dport ntp tproxy to [dead::beef] accept
       udp dport ssh tproxy to :2222 accept
    }
}
table inet x {
    chain y {
        type filter hook prerouting priority mangle; policy accept;
        tcp dport 321 tproxy to :22 accept
        tcp dport 99 tproxy ip to 1.1.1.1:999 accept
        udp dport 155 tproxy ip6 to [dead::beef]:smux accept
    }
}
```

--------------------------------

### Match IPv6 fragment extension header

Source: https://www.netfilter.org/projects/nftables/manpage.html

Example rule using ip6 nexthdr to match packets whose first extension header indicates a fragment.

```nftables
# matching if first extension header indicates a fragment
ip6 nexthdr ipv6-frag
```

--------------------------------

### Match TCP/UDP destination port with th dport

Source: https://www.netfilter.org/projects/nftables/manpage.html

Equivalent to the raw expression example for matching destination ports, using the more convenient 'th dport' notation. Like the raw expression, no dependencies are created or checked; the user must restrict matching to header types with ports.

```nftables
inet filter input meta l4proto {tcp, udp} th dport { 53, 80 }
```

--------------------------------

### Using socket expression in nftables

Source: https://www.netfilter.org/projects/nftables/manpage.html

Examples of using the socket expression in nftables rules. It shows matching transparent sockets, tracing packets with a specific socket mark, setting packet mark to socket mark, and counting packets for a cgroupv2 at a given level.

```nftables
# Mark packets that correspond to a transparent socket. "socket wildcard 0"
# means that zero-bound listener sockets are NOT matched (which is usually
# exactly what you want).
table inet x {
    chain y {
        type filter hook prerouting priority mangle; policy accept;
        socket transparent 1 socket wildcard 0 mark set 0x00000001 accept
    }
}

# Trace packets that corresponds to a socket with a mark value of 15
table inet x {
    chain y {
        type filter hook prerouting priority mangle; policy accept;
        socket mark 0x0000000f nftrace set 1
    }
}

# Set packet mark to socket mark
table inet x {
    chain y {
        type filter hook prerouting priority mangle; policy accept;
        tcp dport 8080 mark set socket mark
    }
}

# Count packets for cgroupv2 "user.slice" at level 1
table inet x {
    chain y {
        type filter hook input priority filter; policy accept;
        socket cgroupv2 level 1 "user.slice" counter
    }
}
```

--------------------------------

### Using meta expressions in nftables

Source: https://www.netfilter.org/projects/nftables/manpage.html

Shows how to use meta expressions in nftables rules. The qualified form uses the 'meta' keyword, while the unqualified form omits it. Examples include matching output interface, interface kind, IPsec processing, and time range matching using the 'hour' meta attribute.

```nftables
# qualified meta expression
filter output meta oif eth0
filter forward meta iifkind { "tun", "veth" }

# unqualified meta expression
filter output oif eth0

# incoming packet was subject to ipsec processing
raw prerouting meta ipsec exists accept

# match incoming packet from 03:00 to 14:00 local time
raw prerouting meta hour "03:00"-"14:00" counter accept
```

--------------------------------

### nft command synopsis

Source: https://www.netfilter.org/projects/nftables/manpage.html

Shows the general command-line syntax for nft, including the main invocation with options, file input, interactive mode, and help/version flags.

```bash
**nft** [ **-nNscaeSupyjtT** ] [ **-I** _directory_ ] [ **-f** _filename_ | **-i** | _cmd_ ...]
**nft** **-h**
**nft** **-v**
```

--------------------------------

### nftables: Dynamic blackhole and flood sets with rate limiting

Source: https://www.netfilter.org/projects/nftables/manpage.html

Complete nftables configuration for dynamic blacklisting and rate limiting. Declares two dynamic sets (blackhole with 1m timeout, flood with 10s timeout), adds rules to whitelist internal interface, drop blacklisted addresses, and add addresses to sets when connection rate exceeds 10/second. Includes commands to list sets and manually add elements.

```bash
nft add set ip filter blackhole \
    "{ type ipv4_addr; flags dynamic; timeout 1m; size 65536; }"

# declare a set to store the limit per saddr.
# This must be separate from blackhole since the timeout is different
nft add set ip filter flood \
    "{ type ipv4_addr; flags dynamic; timeout 10s; size 128000; }"

# whitelist internal interface.
nft add rule ip filter input meta iifname "internal" accept

# drop packets coming from blacklisted ip addresses.
nft add rule ip filter input ip saddr @blackhole counter drop

# add source ip addresses to the blacklist if more than 10 tcp connection
# requests occurred per second and ip address.
nft add rule ip filter input tcp flags syn tcp dport ssh \
    add @flood { ip saddr limit rate over 10/second } \
    add @blackhole { ip saddr } \
    drop

# inspect state of the sets.
nft list set ip filter flood
nft list set ip filter blackhole

# manually add two addresses to the blackhole.
nft add element filter blackhole { 10.2.3.4, 10.23.1.42 }
```

--------------------------------

### describe command syntax

Source: https://www.netfilter.org/projects/nftables/manpage.html

Shows the syntax for the nft describe command, which takes an expression or data type as an argument.

```bash
**describe** _expression_ | _data type_
```

--------------------------------

### FWD statement usage examples

Source: https://www.netfilter.org/projects/nftables/manpage.html

Examples of using the fwd statement to redirect a raw packet to a device and to forward a packet to a next hop, updating the source and destination MAC addresses and decrementing the TTL field.

```nftables
# redirect raw packet to device
netdev ingress fwd to "eth0"

# forward packet to next hop 192.168.200.1 via eth0 device
netdev ingress ether saddr set fwd ip to 192.168.200.1 device "eth0"
```

--------------------------------

### Match inner TCP port in gretap

Source: https://www.netfilter.org/projects/nftables/manpage.html

Example rule that matches packets with an inner TCP destination port 80 encapsulated in gretap.

```nftables
netdev filter ingress gretap tcp dport 80 counter
```

--------------------------------

### Trace incoming packets from host 10.0.0.1

Source: https://www.netfilter.org/projects/nftables/manpage.html

Traces incoming packets from host 10.0.0.1. The first command enables nftrace on matching packets, and the second command monitors trace events.

```nft
% nft add rule filter input ip saddr 10.0.0.1 meta nftrace set 1
% nft monitor trace
```

--------------------------------

### Match inner IPv4 destination in GRE

Source: https://www.netfilter.org/projects/nftables/manpage.html

Example rule that matches packets with an inner IPv4 destination address of 9.9.9.9 encapsulated in GRE.

```nftables
netdev filter ingress gre ip daddr 9.9.9.9 counter
```

--------------------------------

### Listen to all events in native nft format

Source: https://www.netfilter.org/projects/nftables/manpage.html

Listens to all nf_tables events and reports them in native nft format. Press ^C to finish the monitor operation.

```nft
% nft monitor
```

--------------------------------

### monitor command syntax

Source: https://www.netfilter.org/projects/nftables/manpage.html

Syntax for the `monitor` command. Use `monitor new` or `monitor destroy` to filter by action, and specify an object type to filter by object. The `monitor trace` form prints events for packets with nftrace enabled.

```nft
**monitor** [**new** | **destroy**] _MONITOR_OBJECT_
**monitor** **trace**

_MONITOR_OBJECT_ := **tables** | **chains** | **sets** | **rules** | **elements** | **ruleset**
```

--------------------------------

### Defining and assigning ct expectation policy

Source: https://www.netfilter.org/projects/nftables/manpage.html

Example nftables configuration that defines a ct expectation object and assigns it in a chain using the 'ct expectation set' statement.

```nft
table ip filter {
        ct expectation expect {
                protocol udp
                dport 9876
                timeout 2m
                size 8
                l3proto ip
        }

        chain input {
                type filter hook input priority filter; policy accept;
                ct expectation set "expect"
        }
}
```

--------------------------------

### Counter add/delete/list syntax

Source: https://www.netfilter.org/projects/nftables/manpage.html

Syntax for adding, deleting, and listing counters. The add command can include initial packet/byte counts and a comment.

```nft
**add** **counter** [_family_] _table_ _name_ [**{** [ **packets** _packets_ **bytes** _bytes_ _;_ ] [ **comment** _comment_ _;_ **}**]
**delete** **counter** [_family_] _table_ _name_
**list** **counters**
```

--------------------------------

### Match inner TCP port in VXLAN

Source: https://www.netfilter.org/projects/nftables/manpage.html

Example rule that matches packets with an inner TCP destination port 80 encapsulated in VXLAN, after matching UDP destination port 4789.

```nftables
netdev filter ingress udp dport 4789 vxlan tcp dport 80 counter
```

--------------------------------

### Include file with include statement

Source: https://www.netfilter.org/projects/nftables/manpage.html

Includes another file in the nft ruleset. The file is searched in directories specified by the -I/--includepath option, or in the default compile-time directory if not specified. Wildcards are supported and no error is raised if no matches are found.

```nft
**include** _filename_
```

--------------------------------

### Using named quotas

Source: https://www.netfilter.org/projects/nftables/manpage.html

Commands to create a named quota and add a rule that uses it via 'quota name'.

```nft
nft add quota filter user123 { over 20 mbytes }
nft add rule filter input ip saddr 192.168.10.123 quota name "user123"
```

--------------------------------

### Match inner TCP port in GENEVE

Source: https://www.netfilter.org/projects/nftables/manpage.html

Example rule that matches packets with an inner TCP destination port 80 encapsulated in GENEVE, after matching UDP destination port 4789.

```nftables
netdev filter ingress udp dport 4789 geneve tcp dport 80 counter
```

--------------------------------

### rt expression examples

Source: https://www.netfilter.org/projects/nftables/manpage.html

Shows rt expression usage for classid, nexthop (with family-specific variants), and ipsec exists. The ipsec exists variant checks if the outgoing packet will be encapsulated/encrypted by IPsec.

```nft
# IP family independent rt expression
filter output rt classid 10

# IP family dependent rt expressions
ip filter output rt nexthop 192.168.0.1
ip6 filter output rt nexthop fd00::1
inet filter output rt ip nexthop 192.168.0.1
inet filter output rt ip6 nexthop fd00::1

# outgoing packet will be encapsulated/encrypted by ipsec
filter output rt ipsec exists
```

--------------------------------

### Quota add/delete/list syntax

Source: https://www.netfilter.org/projects/nftables/manpage.html

Syntax for adding, deleting, and listing quotas. The add command requires a quota limit with a byte unit (bytes, kbytes, mbytes) and optional 'over' or 'until' prefix, plus optional 'used' and comment.

```nft
**add** **quota** [_family_] _table_ _name_ **{** [**over**|**until**] _bytes_ _BYTE_UNIT_ [ **used** _bytes_ _BYTE_UNIT_ ] _;_ [ **comment** _comment_ _;_ ] **}**
BYTE_UNIT := bytes | kbytes | mbytes
**delete** **quota** [_family_] _table_ _name_
**list** **quotas**
```

--------------------------------

### Using symbolic variables in nft

Source: https://www.netfilter.org/projects/nftables/manpage.html

Example of using symbolic variables in nft. Defines two interfaces, creates a set of them, redefines one, undefines it, and then uses the set in a filter rule.

```nft
define int_if1 = eth0
define int_if2 = eth1
define int_ifs = { $int_if1, $int_if2 }
redefine int_if2 = wlan0
undefine int_if2

filter input iif $int_ifs accept
```

--------------------------------

### DUP statement examples

Source: https://www.netfilter.org/projects/nftables/manpage.html

Shows the dup statement usage in nftables: duplicating a packet to a specific IP address and device, copying a raw frame to another interface, and using a map to select the destination device based on the destination IP address.

```nftables
# send to machine with ip address 10.2.3.4 on eth0
ip filter forward dup to 10.2.3.4 device "eth0"

# copy raw frame to another interface
netdev ingress dup to "eth0"
dup to "eth0"

# combine with map dst addr to gateways
dup to ip daddr map { 192.168.7.1 : "eth0", 192.168.7.2 : "eth1" }
```

--------------------------------

### Add, change, delete a table in nft interactive mode

Source: https://www.netfilter.org/projects/nftables/manpage.html

Interactive nft session showing table and chain creation, adding a counter rule, and toggling the `dormant` flag to disable and re-enable the table. The `dormant` flag unregisters base chains so rules are not evaluated.

```nft
# start nft in interactive mode
nft --interactive

# create a new table.
create table inet mytable

# add a new base chain: get input packets
add chain inet mytable myin { type filter hook input priority filter; }

# add a single counter to the chain
add rule inet mytable myin counter

# disable the table temporarily -- rules are not evaluated anymore
add table inet mytable { flags dormant; }

# make table active again:
add table inet mytable
```

--------------------------------

### Using named quotas with maps

Source: https://www.netfilter.org/projects/nftables/manpage.html

Commands to create two named quotas and add a rule that uses a map to select the quota based on the source IP address.

```nft
nft add quota filter user123 { over 20 mbytes }
nft add quota filter user124 { over 20 mbytes }
nft add rule filter input quota name ip saddr map { 192.168.10.123 : "user123", 192.168.10.124 : "user124" }
```

--------------------------------

### nftables set commands syntax

Source: https://www.netfilter.org/projects/nftables/manpage.html

Syntax for add, delete, destroy, list, flush, and reset commands for sets. The add command requires a set specification as described in the table.

```nftables
**add** |  Add a new set in the specified table. See the Set specification table below for more information about how to specify properties of a set.   
  
---|---  
**delete** |  Delete the specified set.   
  
**destroy** |  Delete the specified set, it does not fail if it does not exist.   
  
**list** |  Display the elements in the specified set.   
  
**flush** |  Remove all elements from the specified set.   
  
**reset** |  Reset state in all contained elements, e.g. counter and quota statement values.   
  
  
```

--------------------------------

### Raw payload expression syntax

Source: https://www.netfilter.org/projects/nftables/manpage.html

Syntax for the raw payload expression in nftables. It loads _length_ bits starting at _offset_ bits, where bit 0 is the topmost bit (0x80 in an octet). No protocol dependencies are added automatically, so you must manually exclude packets with different transport headers, e.g., using 'meta l4proto 5'.

```nftables
**@**_base_**,**_offset_**,**_length_
```

--------------------------------

### nft table command syntax

Source: https://www.netfilter.org/projects/nftables/manpage.html

Syntax for table management commands in nftables. Use `add` to create a table without error if it exists, `create` to fail if it already exists, and `delete`, `destroy`, `list`, or `flush` to manage existing tables. The optional `_family_` defaults to `ip` when omitted.

```nft
{**add** | **create**} **table** [_family_] _table_ [**{** [**comment** _comment_ **;**] [**flags** _flags_ **;**] **}**]
{**delete** | **destroy** | **list** | **flush**} **table** [_family_] _table_
**list tables** [_family_]
**delete table** [_family_] **handle** _handle_
**destroy table** [_family_] **handle** _handle_
```

--------------------------------

### nft set management syntax

Source: https://www.netfilter.org/projects/nftables/manpage.html

Syntax for managing named sets and their elements. Includes commands to add, delete, destroy, list, flush, and reset sets, as well as adding or deleting elements.

```nft
**add set** [_family_] _table_ _set_ **{ type** _type_ | **typeof** _expression_ **;** [**flags** _flags_ **;**] [**timeout** _timeout_ **;**] [**gc-interval** _gc-interval_ **;**] [**elements = {** _element_[**,** ...] **} ;**] [**size** _size_ **;**] [**comment** _comment_ **;**_] [___**policy**_ 'policy_ **;**] [**auto-merge ;**] **}**
{**delete** | **destroy** | **list** | **flush** | **reset** } **set** [_family_] _table_ _set_
**list sets** [_family_] [_table_]
**delete set** [_family_] _table_ **handle** _handle_
{**add** | **delete** | **destroy** } **element** [_family_] _table_ _set_ **{** _element_[**,** ...] **}**
```

--------------------------------

### list hooks syntax

Source: https://www.netfilter.org/projects/nftables/manpage.html

Shows the syntax for listing registered hooks for a protocol family. Use `list hooks netdev` with an optional device name to filter hooks for a specific network device.

```nft
**list hooks** [_family_]
**list hooks netdev** [ **device** _DEVICE_NAME_ ]
```

--------------------------------

### ct expectation add/delete/list syntax

Source: https://www.netfilter.org/projects/nftables/manpage.html

Syntax for adding, deleting, and listing ct expectations. The add command requires protocol, dport, timeout, and size; l3proto defaults to the table family.

```nft
**add** **ct expectation**  [_family_] _table_ _name_ **{ protocol** _protocol_ **; dport** _dport_ **; timeout** _timeout_ **; size** _size_ **;** [**l3proto** _family_ **;**] **}**
**delete** **ct expectation**  [_family_] _table_ _name_
**list** **ct expectations**
```

--------------------------------

### Using named counters

Source: https://www.netfilter.org/projects/nftables/manpage.html

Commands to create a named counter and add a rule that uses it via 'counter name'.

```nft
nft add counter filter http
nft add rule filter input tcp dport 80 counter name "http"
```

--------------------------------

### Listen to chain events in native nft format

Source: https://www.netfilter.org/projects/nftables/manpage.html

Listens to both new and destroyed chains and reports them in native nft format.

```nft
% nft monitor chains
```

--------------------------------

### Match input interface by name

Source: https://www.netfilter.org/projects/nftables/manpage.html

Matches packets arriving on interface foo by name. Contrast with matching by interface index using meta iif.

```nftables
filter input meta iif "foo"
```

--------------------------------

### nftables NAT prefix and address/port map rules

Source: https://www.netfilter.org/projects/nftables/manpage.html

Two nftables NAT rules: the first maps a source IP prefix to another prefix (e.g., 10.141.11.4 becomes 192.168.2.4), and the second maps a source address and TCP destination port to a pool of destination addresses and ports. The second rule generates a NAT expression that expects a tuple of IP address (min), source port (min), IP address (max), and source port (max) from the map, with inclusive ranges.

```nftables
add rule nat postrouting snat ip prefix to ip saddr map { 10.141.11.0/24 : 192.168.2.0/24 }
```

```nftables
add rule nat postrouting dnat to ip saddr . tcp dport map { 192.168.1.2 . 80 : 10.141.10.2-10.141.10.5 . 8888-8999 }
```

--------------------------------

### nftables stateful object command syntax

Source: https://www.netfilter.org/projects/nftables/manpage.html

Syntax for managing stateful objects (counter, quota, limit) in nftables. Commands include add, delete, destroy, list, and reset. Objects are attached to tables and referenced in rules using 'type name'.

```nft
{**add** | **delete** | **destroy** | **list** | **reset**} **counter** [_family_] _table_ _object_
{**add** | **delete** | **destroy** | **list** | **reset**} **quota** [_family_] _table_ _object_
{**add** | **delete** | **destroy** | **list**} **limit** [_family_] _table_ _object_
**delete** _counter_ [_family_] _table_ **handle** _handle_
**delete** _quota_ [_family_] _table_ **handle** _handle_
**delete** _limit_ [_family_] _table_ **handle** _handle_
**destroy** _counter_ [_family_] _table_ **handle** _handle_
**destroy** _quota_ [_family_] _table_ **handle** _handle_
**destroy** _limit_ [_family_] _table_ **handle** _handle_
**list** { **counters** | **limits** | **quotas** } [_family_] [_table_]
**reset** { **counters** | **quotas** } [_family_] [_table_]

```

--------------------------------

### nft add rule with named sets

Source: https://www.netfilter.org/projects/nftables/manpage.html

References named sets in a rule using the @ prefix. The sets allowed_hosts and allowed_ports must be created before this rule is added.

```bash
nft add rule filter input ip saddr @allowed_hosts tcp dport @allowed_ports accept
```
Tokens:
Raw