nftables ip set multiple tables

bash_bob

Use case: I have a home router using iptables today. I'm researching converting over to nftables, as it looks to be much more manageable for a lot of rules. One thing I have setup today under iptables is a 'country-block' ipset which contains country CIDR blocks that covers the majority of random port probe/hack attempts. Unfortunately nftables can't use my existing ipsets directly, but it was fairly straightforward to convert it to an nftables...

Originally asked by Mark on Stack Exchange (unix) (CC BY-SA 3.0).

uphilltech

Great question — answering as the UphillTech team:

I received a response from the nftables developers after asking on their mail list. The short answer is that referencing sets in another table is not possible. However, I was at least able to store my sets in a separate file and bring them in via an @include. This makes my ipsets more manageable instead of having to put them all into a single massive configuration file. The syntax is like so: # nftables.conf include "/etc/nftables.country-block" table inet filter { set country-block { type ipv4_addr; flags interval; elements = $country_block_list } } # nftables.country-block define country_block_list = { # comma-separated CIDR blocks here } But it's worth noting that as of this writing...

Full answer by Mark: https://unix.stackexchange.com/a/331959 (CC BY-SA 3.0).

Need it done for your business? UphillTech.