Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

3
  • Thanks, you saved my day. You got my problem solved. It works really well! Commented Apr 27, 2020 at 5:34
  • 1
    This is the kind of extremely informative answer that should be a model for all others. What many might consider the 'extra stuff' was phenomenally useful to me, and are very close natural follow-ups that saved me much additional searching for each point. I will post a separate question about an error performing the final recommended operation, and an answer there should probably lead to an edit here. Stay tuned. Commented May 15, 2020 at 0:05
  • Just as a side note, potentially typeof ip <saddr|daddr> (>0.9.4) for sets could do away with the requirement to have separate rules and sets for IPv4 and IPv6. With good old ipset it was possible to create a set of sets (where the contained sets where IPv4 or IPv6 specific) and then update/insert elements to that "superset". It appears nftables is somewhat late learning that very useful trick, while otherwise it pretty much promises the ability to unify rules across IPv4 and IPv6. Commented May 1, 2021 at 23:01