AnswerBun.com

Change policy with nftables on command line

Server Fault Asked on January 3, 2022

With iptables I can change the for example INPUT policy with iptables -P INPUT DROP to drop. Is there any option to do the same with nft?

Editing /etc/nftables.conf would work of course but that is not what I want.

One Answer

Yes you can redefine an already existing base chain's policy without changing its content. There's no separate keyword for this, it's still add:

nft add chain family mytable mychain '{ policy drop; }'

Complete example in a namespace:

test.nft:

flush ruleset

table ip t {
    chain c {
        type filter hook output priority 0; policy accept;
        oif lo accept
        counter
    }
}

setup:

# ip netns add test
# ip netns exec test nft -f test.nft

alteration:

# ip netns exec test nft add 'chain ip t c { policy drop; }'
# ip netns exec test nft list ruleset
table ip t {
    chain c {
        type filter hook output priority filter; policy drop;
        oif "lo" accept
        counter packets 0 bytes 0
    }
}

The policy was changed, without altering the rules. Using here nft 0.9.5 and kernel 5.7.x . Depending on version behaviour might differ.

There's a kernel commit from 2015 allowing to do only this:

netfilter: nf_tables: allow to change chain policy without hook if it exists

If there's an existing base chain, we have to allow to change the default policy without indicating the hook information.

However, if the chain doesn't exists, we have to enforce the presence of the hook attribute.

Signed-off-by: Pablo Neira Ayuso [email protected]

Before this (around kernel 4.1), one had to provide again the base chain definition (which can't be changed by the way):

# ip netns exec test nft add 'chain ip t c { type filter hook output priority 0;  policy drop; }'

Answered by A.B on January 3, 2022

Add your own answers!

Related Questions

Apache reverse proxy from root to context

1  Asked on December 13, 2021 by jzonthemtn

   

Barman: rsync wal archival stalls on some files

1  Asked on December 13, 2021 by thoro

       

Unable to port forward via ssh on windows

1  Asked on December 13, 2021 by justtryingnottofail

     

git clone does not work in (sshfs) mapped drive in windows

0  Asked on December 13, 2021 by dhanabal-m

     

OpenSSL – error in SSLv2/v3 read client hello A

1  Asked on December 13, 2021 by tuyen-nguyen

   

Prevent port change on redirect in nginx

5  Asked on December 11, 2021 by arbales

       

PHP-FPM does not automatically start after reboot

3  Asked on December 11, 2021 by steveedson

         

Postgres roles best practice implementation

1  Asked on December 11, 2021 by jp-beaudry

   

Rinetd failing to run

1  Asked on December 11, 2021 by opad

   

Nagios service check interval based on host type

2  Asked on December 11, 2021 by sebastien-prudhomme

 

Cannot connect to Linux Samba share from Windows 10

15  Asked on December 11, 2021 by pngl

       

Ask a Question

Get help from others!

© 2023 AnswerBun.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP