Provided by: nftables_0.5+snapshot20151106-1_amd64 bug

NAME

       nft - Administration tool for packet filtering and classification

SYNOPSIS

       nft [ -n/--numeric ] [ -I/--includepath directory ] [ -f/--file filename |
           -i/--interactive | cmd ...]
       nft [ -h/--help ] [ -v/--version ]

DESCRIPTION

       nft is used to set up, maintain and inspect packet filtering and classification  rules  in
       the Linux kernel.

OPTIONS

       For a full summary of options, run nft --help.

       -h/--help
              Show help message and all options.

       -v/--version
              Show version.

       -n/--numeric
              Numeric  output: Addresses and other information that might need network traffic to
              resolve to symbolic names are shown  numerically  (default  behaviour).  When  used
              twice,  internet  services  are  translated. When used twice, internet services and
              UIDs/GIDs are also shown numerically. When used three times, protocol  numbers  are
              also shown numerically.

       -N     Translate IP addresses to DNS names.

       -a/--handle
              Show rule handles in output.

       -I/--includepath directory
              Add  the directory directory to the list of directories to by searched for included
              files.

       -f/--file filename
              Read input from filename.

       -i/--interactive
              Read input from an interactive readline CLI.

INPUT FILE FORMAT

   LEXICAL CONVENTIONS
       Input is parsed line-wise. When the last character of  a  line  just  before  the  newline
       character  is  a  non-quoted  backslash  (\),  the next line is treated as a continuation.
       Multiple commands on the same line can be separated using a semicolon (;).

       A hash sign (#) begins a comment. All following characters on the same line are ignored.

       Identifiers  begin  with  an  alphabetic  character  (a-z,A-Z),  followed  zero  or   more
       alphanumeric  characters  (a-z,A-Z,0-9)  and  the  characters  slash  (/),  backslash (\),
       underscore (_) and dot (.). Identifiers using different  characters  or  clashing  with  a
       keyword need to be enclosed in double quotes (").

   INCLUDE FILES
       include filename

       Other  files  can  be  included  by  using  the  include statement.  The directories to be
       searched for include files can be specified using the -I/--includepath option.

   SYMBOLIC VARIABLES
       define variable expr
       $variable

       Symbolic variables can be defined using the define  statement.   Variable  references  are
       expressions  and can be used initialize other variables.  The scope of a definition is the
       current block and all blocks contained within.

       Using symbolic variables

       define int_if1 = eth0
       define int_if2 = eth1
       define int_ifs = { $int_if1, $int_if2 }

       filter input iif $int_ifs accept

ADDRESS FAMILIES

       Address families determine the type of packets  which  are  processed.  For  each  address
       family  the  kernel  contains  so called hooks at specific stages of the packet processing
       paths, which invoke nftables if rules for these hooks exist.

       ip     IPv4 address family.

       ip6    IPv6 address family.

       inet   Internet (IPv4/IPv6) address family.

       arp    ARP address family, handling packets vi

       bridge Bridge address family, handling packets which traverse a bridge device.

       netdev Netdev address family, handling packets from ingress.

       All  nftables  objects  exist  in  address  family  specific  namespaces,  therefore   all
       identifiers  include  an  address family. If an identifier is specified without an address
       family, the ip family is used by default.

   IPV4/IPV6/INET ADDRESS FAMILIES
       The IPv4/IPv6/Inet address families handle IPv4, IPv6  or  both  types  of  packets.  They
       contain five hooks at different packet processing stages in the network stack.

       IPv4/IPv6/Inet address family hooks

       ┌────────────┬──────────────────────────────────┐
       │Hook        │ Description                      │
       ├────────────┼──────────────────────────────────┤
       │prerouting  │ All  packets entering the system │
       │            │ are processed by the  prerouting │
       │            │ hook.  It  is invoked before the │
       │            │ routing process and is used  for │
       │            │ early   filtering   or  changing │
       │            │ packet  attributes  that  affect │
       │            │ routing.                         │
       ├────────────┼──────────────────────────────────┤
       │input       │ Packets  delivered  to the local │
       │            │ system  are  processed  by   the │
       │            │ input hook.                      │
       ├────────────┼──────────────────────────────────┤
       │forward     │ Packets forwarded to a different │
       │            │ host  are   processed   by   the │
       │            │ forward hook.                    │
       ├────────────┼──────────────────────────────────┤
       │output      │ Packets  sent by local processes │
       │            │ are  processed  by  the   output │
       │            │ hook.                            │
       ├────────────┼──────────────────────────────────┤
       │postrouting │ All  packets  leaving the system │
       │            │ are processed by the postrouting │
       │            │ hook.                            │
       └────────────┴──────────────────────────────────┘
   ARP ADDRESS FAMILY
       The ARP address family handles ARP packets received and sent by the system. It is commonly
       used to mangle ARP packets for clustering.

       ARP address family hooks

       ┌───────┬──────────────────────────────────┐
       │Hook   │ Description                      │
       ├───────┼──────────────────────────────────┤
       │input  │ Packets delivered to  the  local │
       │       │ system   are  processed  by  the │
       │       │ input hook.                      │
       ├───────┼──────────────────────────────────┤
       │output │ Packets send by the local system │
       │       │ are   processed  by  the  output │
       │       │ hook.                            │
       └───────┴──────────────────────────────────┘
   BRIDGE ADDRESS FAMILY
       The bridge address family handles ethernet packets traversing bridge devices.

   NETDEV ADDRESS FAMILY
       The Netdev address family handles packets from ingress.

       Netdev address family hooks

       ┌────────┬──────────────────────────────────┐
       │Hook    │ Description                      │
       ├────────┼──────────────────────────────────┤
       │ingress │ All packets entering the  system │
       │        │ are  processed  by this hook. It │
       │        │ is  invoked   before   layer   3 │
       │        │ protocol  handlers and it can be │
       │        │ used  for  early  filtering  and │
       │        │ policing.                        │
       └────────┴──────────────────────────────────┘

TABLES

       {add | delete | list | flush} table [family] {table}

       Tables are containers for chains and sets. They are identified by their address family and
       their name. The address family must be one of ip, ip6, inet,  arp,  bridge,  netdev.   The
       inet  address  family  is  a dummy family which is used to create hybrid IPv4/IPv6 tables.
       When no address family is specified, ip is used by default.

       add    Add a new table for the given family with the given name.

       delete Delete the specified table.

       list   List all chains and rules of the specified table.

       flush  Flush all chains and rules of the specified table.

CHAINS

       {add} chain [family] {table} {chain} {hook} {priority} {policy} {device}
       {add | create | delete | list | flush} chain [family] {table} {chain}
       {rename} chain [family] {table} {chain} {newname}

       Chains are containers for rules. They exist in two kinds, base chains and regular  chains.
       A  base chain is an entry point for packets from the networking stack, a regular chain may
       be used as jump target and is used for better rule organization.

       add    Add a new chain in the  specified  table.  When  a  hook  and  priority  value  are
              specified,  the  chain  is  created as a base chain and hooked up to the networking
              stack.

       create Simlar to the add command, but returns an error if the chain already exists.

       delete Delete the specified chain. The chain must not contain any rules or be used as jump
              target.

       rename Rename the specified chain.

       list   List all rules of the specified chain.

       flush  Flush all rules of the specified chain.

RULES

       [add | insert] rule [family] {table} {chain} [position position] {statement}...
       {delete} rule [family] {table} {chain} {handle handle}

       Rules  are  constructed  from  two  kinds  of components according to a set of grammatical
       rules: expressions and statements.

       add    Add a new rule described by the list of statements. The rule  is  appended  to  the
              given  chain  unless a position is specified, in which case the rule is appended to
              the rule given by the position.

       insert Similar to the add command, but the rule is prepended to the beginning of the chain
              or before the rule at the given position.

       delete Delete the specified rule.

EXPRESSIONS

       Expressions  represent  values, either constants like network addresses, port numbers etc.
       or data gathered from the packet during ruleset evaluation. Expressions  can  be  combined
       using  binary,  logical,  relational  and  other  types  of expressions to form complex or
       relational (match) expressions.  They are also used  as  arguments  to  certain  types  of
       operations, like NAT, packet marking etc.

       Each  expression has a data type, which determines the size, parsing and representation of
       symbolic values and type compatibility with other expressions.

   DESCRIBE COMMAND
       describe {expression}

       The describe command shows information about the type of an expression and its data type.

       The describe command

       $ nft describe tcp flags
       payload expression, datatype tcp_flag (TCP flag) (basetype bitmask, integer), 8 bits

       pre-defined symbolic constants:
       fin                                0x01
       syn                                0x02
       rst                                0x04
       psh                                0x08
       ack                                0x10
       urg                                0x20
       ecn                                0x40
       cwr                                0x80

DATA TYPES

       Data types determine the size, parsing and representation  of  symbolic  values  and  type
       compatibility  of  expressions.  A  number  of  global  data types exist, in addition some
       expression types define further data types specific to  the  expression  type.  Most  data
       types have a fixed size, some however may have a dynamic size, f.i. the string type.

       Types  may  be  derived from lower order types, f.i. the IPv4 address type is derived from
       the integer type, meaning an IPv4 address can also be specified as an integer value.

       In certain contexts (set and map definitions) it is necessary to explicitly specify a data
       type.  Each type has a name which is used for this.

   INTEGER TYPE
       ┌────────┬─────────┬──────────┬───────────┐
       │Name    │ Keyword │ Size     │ Base type │
       ├────────┼─────────┼──────────┼───────────┤
       │Integer │ integer │ variable │ -         │
       └────────┴─────────┴──────────┴───────────┘
       The  integer  type is used for numeric values. It may be specified as decimal, hexadecimal
       or octal number. The integer type doesn't have a fixed size, its size is determined by the
       expression for which it is used.

   BITMASK TYPE
       ┌────────┬─────────┬──────────┬───────────┐
       │Name    │ Keyword │ Size     │ Base type │
       ├────────┼─────────┼──────────┼───────────┤
       │Bitmask │ bitmask │ variable │ integer   │
       └────────┴─────────┴──────────┴───────────┘
       The bitmask type (bitmask) is used for bitmasks.

   STRING TYPE
       ┌───────┬─────────┬──────────┬───────────┐
       │Name   │ Keyword │ Size     │ Base type │
       ├───────┼─────────┼──────────┼───────────┤
       │String │ string  │ variable │ -         │
       └───────┴─────────┴──────────┴───────────┘
       The  string  type  is  used  to  for character strings. A string begins with an alphabetic
       character (a-zA-Z) followed by zero or more alphanumeric characters or the  characters  /,
       -, _ and .. In addition anything enclosed in double quotes (") is recognized as a string.

       String specification

       # Interface name
       filter input iifname eth0

       # Weird interface name
       filter input iifname "(eth0)"

   LINK LAYER ADDRESS TYPE
       ┌───────────────────┬─────────┬──────────┬───────────┐
       │Name               │ Keyword │ Size     │ Base type │
       ├───────────────────┼─────────┼──────────┼───────────┤
       │Link layer address │ lladdr  │ variable │ integer   │
       └───────────────────┴─────────┴──────────┴───────────┘
       The  link  layer  address  type is used for link layer addresses. Link layer addresses are
       specified as a variable amount of groups of two hexadecimal digits separated using  colons
       (:).

       Link layer address specification

       # Ethernet destination MAC address
       filter input ether daddr 20:c9:d0:43:12:d9

   IPV4 ADDRESS TYPE
       ┌─────────────┬───────────┬────────┬───────────┐
       │Name         │ Keyword   │ Size   │ Base type │
       ├─────────────┼───────────┼────────┼───────────┤
       │IPv4 address │ ipv4_addr │ 32 bit │ integer   │
       └─────────────┴───────────┴────────┴───────────┘
       The IPv4 address type is used for IPv4 addresses. Addresses are specified in either dotted
       decimal, dotted hexadecimal, dotted octal, decimal, hexadecimal, octal notation  or  as  a
       host name. A host name will be resolved using the standard system resolver.

       IPv4 address specification

       # dotted decimal notation
       filter output ip daddr 127.0.0.1

       # host name
       filter output ip daddr localhost

   IPV6 ADDRESS TYPE
       ┌─────────────┬───────────┬─────────┬───────────┐
       │Name         │ Keyword   │ Size    │ Base type │
       ├─────────────┼───────────┼─────────┼───────────┤
       │IPv6 address │ ipv6_addr │ 128 bit │ integer   │
       └─────────────┴───────────┴─────────┴───────────┘
       The IPv6 address type is used for IPv6 addresses. FIXME

       IPv6 address specification

       # abbreviated loopback address
       filter output ip6 daddr ::1

PRIMARY EXPRESSIONS

       The  lowest  order expression is a primary expression, representing either a constant or a
       single datum from a packet's payload, meta data or a stateful module.

   META EXPRESSIONS
       meta {length | nfproto | l4proto | protocol | priority}
       [meta] {mark | iif | iifname | iiftype | oif | oifname | oiftype | skuid | skgid | nftrace
       | rtclassid}

       A meta expression refers to meta data associated with a packet.

       There  are  two  types  of  meta  expressions: unqualified and qualified meta expressions.
       Qualified meta expressions require the meta keyword before the meta key, unqualified  meta
       expressions  can  be  specified  by  using  the  meta  key  directly  or as qualified meta
       expressions.

       Meta expression types

       ┌──────────┬──────────────────────────┬──────────────────┐
       │Keyword   │ Description              │ Type             │
       ├──────────┼──────────────────────────┼──────────────────┤
       │length    │ Length of the packet  in │ integer (32 bit) │
       │          │ bytes                    │                  │
       ├──────────┼──────────────────────────┼──────────────────┤
       │protocol  │ Ethertype protocol value │ ether_type       │
       ├──────────┼──────────────────────────┼──────────────────┤
       │priority  │ TC packet priority       │ integer (32 bit) │
       ├──────────┼──────────────────────────┼──────────────────┤
       │mark      │ Packet mark              │ packetmark       │
       ├──────────┼──────────────────────────┼──────────────────┤
       │iif       │ Input interface index    │ iface_index      │
       ├──────────┼──────────────────────────┼──────────────────┤
       │iifname   │ Input interface name     │ string           │
       ├──────────┼──────────────────────────┼──────────────────┤
       │iiftype   │ Input interface type     │ iface_type       │
       ├──────────┼──────────────────────────┼──────────────────┤
       │oif       │ Output interface index   │ iface_index      │
       ├──────────┼──────────────────────────┼──────────────────┤
       │oifname   │ Output interface name    │ string           │
       ├──────────┼──────────────────────────┼──────────────────┤
       │oiftype   │ Output         interface │ iface_type       │
       │          │ hardware type            │                  │
       ├──────────┼──────────────────────────┼──────────────────┤
       │skuid     │ UID   associated    with │ uid              │
       │          │ originating socket       │                  │
       ├──────────┼──────────────────────────┼──────────────────┤
       │skgid     │ GID    associated   with │ gid              │
       │          │ originating socket       │                  │
       ├──────────┼──────────────────────────┼──────────────────┤
       │rtclassid │ Routing realm            │ realm            │
       └──────────┴──────────────────────────┴──────────────────┘
       Meta expression specific types

       ┌────────────┬──────────────────────────────────┐
       │Type        │ Description                      │
       ├────────────┼──────────────────────────────────┤
       │iface_index │ Interface index (32 bit number). │
       │            │ Can  be specified numerically or │
       │            │ as   name   of    an    existing │
       │            │ interface.                       │
       ├────────────┼──────────────────────────────────┤
       │ifname      │ Interface name (16 byte string). │
       │            │ Does not have to exist.          │
       ├────────────┼──────────────────────────────────┤
       │iface_type  │ Interface type (16 bit number).  │
       ├────────────┼──────────────────────────────────┤
       │uid         │ User ID (32 bit number). Can  be │
       │            │ specified numerically or as user │
       │            │ name.                            │
       ├────────────┼──────────────────────────────────┤
       │gid         │ Group ID (32 bit number). Can be │
       │            │ specified   numerically   or  as │
       │            │ group name.                      │
       ├────────────┼──────────────────────────────────┤
       │realm       │ Routing Realm (32  bit  number). │
       │            │ Can  be specified numerically or │
       │            │ as  symbolic  name  defined   in │
       │            │ /etc/iproute2/rt_realms.         │
       └────────────┴──────────────────────────────────┘
       Using meta expressions

       # qualified meta expression
       filter output meta oif eth0

       # unqualified meta expression
       filter output oif eth0

PAYLOAD EXPRESSIONS

       Payload expressions refer to data from the packet's payload.

   ETHERNET HEADER EXPRESSION
       ether [ethernet header field]

       Ethernet header expression types

       ┌────────┬─────────────────────────┬────────────┐
       │Keyword │ Description             │ Type       │
       ├────────┼─────────────────────────┼────────────┤
       │daddr   │ Destination MAC address │ ether_addr │
       ├────────┼─────────────────────────┼────────────┤
       │saddr   │ Source MAC address      │ ether_addr │
       ├────────┼─────────────────────────┼────────────┤
       │type    │ EtherType               │ ether_type │
       └────────┴─────────────────────────┴────────────┘
   VLAN HEADER EXPRESSION
       vlan [VLAN header field]

       VLAN header expression

       ┌────────┬──────────────────────────┬──────────────────┐
       │Keyword │ Description              │ Type             │
       ├────────┼──────────────────────────┼──────────────────┤
       │id      │ VLAN ID (VID)            │ integer (12 bit) │
       ├────────┼──────────────────────────┼──────────────────┤
       │cfi     │ Canonical         Format │ flag             │
       │        │ Indicator                │                  │
       ├────────┼──────────────────────────┼──────────────────┤
       │pcp     │ Priority code point      │ integer (3 bit)  │
       ├────────┼──────────────────────────┼──────────────────┤
       │type    │ EtherType                │ ethertype        │
       └────────┴──────────────────────────┴──────────────────┘
   ARP HEADER EXPRESSION
       arp [ARP header field]

       ARP header expression

       ┌────────┬──────────────────────┬─────────────────┐
       │Keyword │ Description          │ Type            │
       ├────────┼──────────────────────┼─────────────────┤
       │htype   │ ARP hardware type    │ FIXME           │
       ├────────┼──────────────────────┼─────────────────┤
       │ptype   │ EtherType            │ ethertype       │
       ├────────┼──────────────────────┼─────────────────┤
       │hlen    │ Hardware address len │ integer (8 bit) │
       ├────────┼──────────────────────┼─────────────────┤
       │plen    │ Protocol address len │ integer (8 bit) │
       ├────────┼──────────────────────┼─────────────────┤
       │op      │ Operation            │ FIXME           │
       └────────┴──────────────────────┴─────────────────┘
   IPV4 HEADER EXPRESSION
       ip [IPv4 header field]

       IPv4 header expression

       ┌──────────┬──────────────────────────┬──────────────────────────┐
       │Keyword   │ Description              │ Type                     │
       ├──────────┼──────────────────────────┼──────────────────────────┤
       │version   │ IP header version (4)    │ integer (4 bit)          │
       ├──────────┼──────────────────────────┼──────────────────────────┤
       │hdrlength │ IP     header     length │ integer  (4  bit)  FIXME │
       │          │ including options        │ scaling                  │
       ├──────────┼──────────────────────────┼──────────────────────────┤
       │tos       │ Type Of Service          │ FIXME                    │
       ├──────────┼──────────────────────────┼──────────────────────────┤
       │length    │ Total packet length      │ integer (16 bit)         │
       ├──────────┼──────────────────────────┼──────────────────────────┤
       │id        │ IP ID                    │ integer (16 bit)         │
       ├──────────┼──────────────────────────┼──────────────────────────┤
       │frag-off  │ Fragment offset          │ integer (16 bit)         │
       ├──────────┼──────────────────────────┼──────────────────────────┤
       │ttl       │ Time to live             │ integer (8 bit)          │
       ├──────────┼──────────────────────────┼──────────────────────────┤
       │protocol  │ Upper layer protocol     │ inet_proto               │
       ├──────────┼──────────────────────────┼──────────────────────────┤
       │checksum  │ IP header checksum       │ integer (16 bit)         │
       ├──────────┼──────────────────────────┼──────────────────────────┤
       │saddr     │ Source address           │ ipv4_addr                │
       ├──────────┼──────────────────────────┼──────────────────────────┤
       │daddr     │ Destination address      │ ipv4_addr                │
       └──────────┴──────────────────────────┴──────────────────────────┘
   IPV6 HEADER EXPRESSION
       ip6 [IPv6 header field]

       IPv6 header expression

       ┌──────────┬───────────────────────┬──────────────────┐
       │Keyword   │ Description           │ Type             │
       ├──────────┼───────────────────────┼──────────────────┤
       │version   │ IP header version (6) │ integer (4 bit)  │
       ├──────────┼───────────────────────┼──────────────────┤
       │priority  │                       │                  │
       ├──────────┼───────────────────────┼──────────────────┤
       │flowlabel │ Flow label            │                  │
       ├──────────┼───────────────────────┼──────────────────┤
       │length    │ Payload length        │ integer (16 bit) │
       ├──────────┼───────────────────────┼──────────────────┤
       │nexthdr   │ Nexthdr protocol      │ inet_proto       │
       ├──────────┼───────────────────────┼──────────────────┤
       │hoplimit  │ Hop limit             │ integer (8 bit)  │
       ├──────────┼───────────────────────┼──────────────────┤
       │saddr     │ Source address        │ ipv6_addr        │
       ├──────────┼───────────────────────┼──────────────────┤
       │daddr     │ Destination address   │ ipv6_addr        │
       └──────────┴───────────────────────┴──────────────────┘
   TCP HEADER EXPRESSION
       tcp [TCP header field]

       TCP header expression

       ┌─────────┬────────────────────────┬──────────────────────────┐
       │Keyword  │ Description            │ Type                     │
       ├─────────┼────────────────────────┼──────────────────────────┤
       │sport    │ Source port            │ inet_service             │
       ├─────────┼────────────────────────┼──────────────────────────┤
       │dport    │ Destination port       │ inet_service             │
       ├─────────┼────────────────────────┼──────────────────────────┤
       │sequence │ Sequence number        │ integer (32 bit)         │
       ├─────────┼────────────────────────┼──────────────────────────┤
       │ackseq   │ Acknowledgement number │ integer (32 bit)         │
       ├─────────┼────────────────────────┼──────────────────────────┤
       │doff     │ Data offset            │ integer  (4  bit)  FIXME │
       │         │                        │ scaling                  │
       ├─────────┼────────────────────────┼──────────────────────────┤
       │reserved │ Reserved area          │ FIXME                    │
       ├─────────┼────────────────────────┼──────────────────────────┤
       │flags    │ TCP flags              │ tcp_flags                │
       ├─────────┼────────────────────────┼──────────────────────────┤
       │window   │ Window                 │ integer (16 bit)         │
       ├─────────┼────────────────────────┼──────────────────────────┤
       │checksum │ Checksum               │ integer (16 bit)         │
       ├─────────┼────────────────────────┼──────────────────────────┤
       │urgptr   │ Urgent pointer         │ integer (16 bit)         │
       └─────────┴────────────────────────┴──────────────────────────┘
   UDP HEADER EXPRESSION
       udp [UDP header field]

       UDP header expression

       ┌─────────┬─────────────────────┬──────────────────┐
       │Keyword  │ Description         │ Type             │
       ├─────────┼─────────────────────┼──────────────────┤
       │sport    │ Source port         │ inet_service     │
       ├─────────┼─────────────────────┼──────────────────┤
       │dport    │ Destination port    │ inet_service     │
       ├─────────┼─────────────────────┼──────────────────┤
       │length   │ Total packet length │ integer (16 bit) │
       ├─────────┼─────────────────────┼──────────────────┤
       │checksum │ Checksum            │ integer (16 bit) │
       └─────────┴─────────────────────┴──────────────────┘
   UDP-LITE HEADER EXPRESSION
       udplite [UDP-Lite header field]

       UDP-Lite header expression

       ┌─────────┬───────────────────┬──────────────────┐
       │Keyword  │ Description       │ Type             │
       ├─────────┼───────────────────┼──────────────────┤
       │sport    │ Source port       │ inet_service     │
       ├─────────┼───────────────────┼──────────────────┤
       │dport    │ Destination port  │ inet_service     │
       ├─────────┼───────────────────┼──────────────────┤
       │cscov    │ Checksum coverage │ integer (16 bit) │
       ├─────────┼───────────────────┼──────────────────┤
       │checksum │ Checksum          │ integer (16 bit) │
       └─────────┴───────────────────┴──────────────────┘
   SCTP HEADER EXPRESSION
       sctp [SCTP header field]

       SCTP header expression

       ┌─────────┬──────────────────┬──────────────────┐
       │Keyword  │ Description      │ Type             │
       ├─────────┼──────────────────┼──────────────────┤
       │sport    │ Source port      │ inet_service     │
       ├─────────┼──────────────────┼──────────────────┤
       │dport    │ Destination port │ inet_service     │
       ├─────────┼──────────────────┼──────────────────┤
       │vtag     │ Verfication Tag  │ integer (32 bit) │
       ├─────────┼──────────────────┼──────────────────┤
       │checksum │ Checksum         │ integer (32 bit) │
       └─────────┴──────────────────┴──────────────────┘
   DCCP HEADER EXPRESSION
       dccp [DCCP header field]

       DCCP header expression

       ┌────────┬──────────────────┬──────────────┐
       │Keyword │ Description      │ Type         │
       ├────────┼──────────────────┼──────────────┤
       │sport   │ Source port      │ inet_service │
       ├────────┼──────────────────┼──────────────┤
       │dport   │ Destination port │ inet_service │
       └────────┴──────────────────┴──────────────┘
   AUTHENTICATION HEADER EXPRESSION
       ah [AH header field]

       AH header expression

       ┌──────────┬──────────────────────────┬──────────────────┐
       │Keyword   │ Description              │ Type             │
       ├──────────┼──────────────────────────┼──────────────────┤
       │nexthdr   │ Next header protocol     │ inet_service     │
       ├──────────┼──────────────────────────┼──────────────────┤
       │hdrlength │ AH Header length         │ integer (8 bit)  │
       ├──────────┼──────────────────────────┼──────────────────┤
       │reserved  │ Reserved area            │ FIXME            │
       ├──────────┼──────────────────────────┼──────────────────┤
       │spi       │ Security Parameter Index │ integer (32 bit) │
       ├──────────┼──────────────────────────┼──────────────────┤
       │sequence  │ Sequence number          │ integer (32 bit) │
       └──────────┴──────────────────────────┴──────────────────┘
   ENCRYPTED SECURITY PAYLOAD HEADER EXPRESSION
       esp [ESP header field]

       ESP header expression

       ┌─────────┬──────────────────────────┬──────────────────┐
       │Keyword  │ Description              │ Type             │
       ├─────────┼──────────────────────────┼──────────────────┤
       │spi      │ Security Parameter Index │ integer (32 bit) │
       ├─────────┼──────────────────────────┼──────────────────┤
       │sequence │ Sequence number          │ integer (32 bit) │
       └─────────┴──────────────────────────┴──────────────────┘
   IPCOMP HEADER EXPRESSION
       ipcomp [IPComp header field]

       IPComp header expression

       ┌────────┬──────────────────────────┬──────────────┐
       │Keyword │ Description              │ Type         │
       ├────────┼──────────────────────────┼──────────────┤
       │nexthdr │ Next header protocol     │ inet_service │
       ├────────┼──────────────────────────┼──────────────┤
       │flags   │ Flags                    │ FIXME        │
       ├────────┼──────────────────────────┼──────────────┤
       │cfi     │ Compression    Parameter │ FIXME        │
       │        │ Index                    │              │
       └────────┴──────────────────────────┴──────────────┘

BLA

   IPV6 EXTENSION HEADER EXPRESSIONS
       IPv6 extension header expressions refer to data from an IPv6 packet's extension headers.

   CONNTRACK EXPRESSIONS
       Conntrack expressions refer to meta data of the connection tracking entry associated  with
       a packet.

       ct {state | direction | status | mark | expiration | helper | l3proto | saddr | daddr |
          protocol | proto-src | proto-dst}

       Conntrack expressions

       ┌───────────┬──────────────────────────┬─────────────────────┐
       │Keyword    │ Description              │ Type                │
       ├───────────┼──────────────────────────┼─────────────────────┤
       │state      │ State of the connection  │ ct_state            │
       ├───────────┼──────────────────────────┼─────────────────────┤
       │direction  │ Direction of the  packet │ ct_dir              │
       │           │ relative      to     the │                     │
       │           │ connection               │                     │
       ├───────────┼──────────────────────────┼─────────────────────┤
       │status     │ Status of the connection │ ct_status           │
       ├───────────┼──────────────────────────┼─────────────────────┤
       │mark       │ Connection mark          │ packetmark          │
       ├───────────┼──────────────────────────┼─────────────────────┤
       │expiration │ Connection    expiration │ time                │
       │           │ time                     │                     │
       ├───────────┼──────────────────────────┼─────────────────────┤
       │helper     │ Helper  associated  with │ string              │
       │           │ the connection           │                     │
       ├───────────┼──────────────────────────┼─────────────────────┤
       │l3proto    │ Layer 3 protocol of  the │ nf_proto FIXME      │
       │           │ connection               │                     │
       ├───────────┼──────────────────────────┼─────────────────────┤
       │saddr      │ Source  address  of  the │ ipv4_addr/ipv6_addr │
       │           │ connection for the given │                     │
       │           │ direction                │                     │
       ├───────────┼──────────────────────────┼─────────────────────┤
       │daddr      │ Destination  address  of │ ipv4_addr/ipv6_addr │
       │           │ the connection  for  the │                     │
       │           │ given direction          │                     │
       ├───────────┼──────────────────────────┼─────────────────────┤
       │protocol   │ Layer  4 protocol of the │ inet_proto          │
       │           │ connection for the given │                     │
       │           │ direction                │                     │
       ├───────────┼──────────────────────────┼─────────────────────┤
       │proto-src  │ Layer  4 protocol source │ FIXME               │
       │           │ for the given direction  │                     │
       ├───────────┼──────────────────────────┼─────────────────────┤
       │proto-dst  │ Layer     4     protocol │ FIXME               │
       │           │ destination    for   the │                     │
       │           │ given direction          │                     │
       └───────────┴──────────────────────────┴─────────────────────┘

STATEMENTS

       Statements represent actions to be performed. They can alter control flow (return, jump to
       a  different  chain,  accept  or drop the packet) or can perform actions, such as logging,
       rejecting a packet, etc.

       Statements exist in two kinds. Terminal statements unconditionally terminate evaluation of
       the  current  rule,  non-terminal  statements either only conditionally or never terminate
       evaluation of the current rule,  in  other  words,  they  are  passive  from  the  ruleset
       evaluation  perspective.  There can be an arbitrary amount of non-terminal statements in a
       rule, but only a single terminal statement as the final statement.

   VERDICT STATEMENT
       The verdict statement alters control flow in the ruleset and issues policy  decisions  for
       packets.

       {accept | drop | queue | continue | return}
       {jump | goto} {chain}

       accept Terminate ruleset evaluation and accept the packet.

       drop   Terminate ruleset evaluation and drop the packet.

       queue  Terminate ruleset evaluation and queue the packet to userspace.

       continue
              Continue ruleset evaluation with the next rule. FIXME

       return Return  from the current chain and continue evaluation at the next rule in the last
              chain. If issued in a base chain, it is equivalent to accept.

       jump chain
              Continue evaluation at the first rule  in  chain.   The  current  position  in  the
              ruleset  is  pushed to a call stack and evaluation will continue there when the new
              chain is entirely evaluated of a return verdict is issued.

       goto chain
              Similar to jump, but the current position is not pushed to the call stack,  meaning
              that  after the new chain evaluation will continue at the last chain instead of the
              one containing the goto statement.

       Verdict statements

       # process packets from eth0 and the internal network in from_lan
       # chain, drop all packets from eth0 with different source addresses.

       filter input iif eth0 ip saddr 192.168.0.0/24 jump from_lan
       filter input iif eth0 drop

   LOG STATEMENT
   REJECT STATEMENT
   COUNTER STATEMENT
   META STATEMENT
   LIMIT STATEMENT
   NAT STATEMENT
   QUEUE STATEMENT

ADDITIONAL COMMANDS

       These are some additional commands included in nft.

   EXPORT
       Export your current ruleset in XML or JSON format to stdout.

       Examples:

       % nft export xml
       [...]
       % nft export json
       [...]

   MONITOR
       The monitor command allows you to listen to  Netlink  events  produced  by  the  nf_tables
       subsystem,  related  to creation and deletion of objects.  When they ocurr, nft will print
       to stdout the monitored events in either XML, JSON or native nft format.

       To filter events related to a concrete object, use one of the keywords 'tables', 'chains',
       'sets', 'rules', 'elements'.

       To filter events related to a concrete action, use keyword 'new' or 'destroy'.

       Hit ^C to finish the monitor operation.

       Listen to all events, report in native nft format

       % nft monitor

       Listen to added tables, report in XML format

       % nft monitor new tables xml

       Listen to deleted rules, report in JSON format

       % nft monitor destroy rules json

       Listen to both new and destroyed chains, in native nft format

       % nft monitor chains

ERROR REPORTING

       When an error is detected, nft shows the line(s) containing the error, the position of the
       erroneous parts in the input stream and marks up the erroneous parts using carrets (^). If
       the error results from the combination of two expressions or statements, the part imposing
       the constraints which are violated is marked using tildes (~).

       For errors returned by the kernel, nft can't detect which parts of the  input  caused  the
       error and the entire command is marked.

       Error caused by single incorrect expression

       <cmdline>:1:19-22: Error: Interface does not exist
       filter output oif eth0
                         ^^^^

       Error caused by invalid combination of two expressions

       <cmdline>:1:28-36: Error: Right hand side of relational expression (==) must be constant
       filter output tcp dport == tcp dport
                               ~~ ^^^^^^^^^

       Error returned by the kernel

       <cmdline>:0:0-23: Error: Could not process rule: Operation not permitted
       filter output oif wlan0
       ^^^^^^^^^^^^^^^^^^^^^^^

EXIT STATUS

       On  success,  nft  exits  with  a  status of 0. Unspecified errors cause it to exit with a
       status of 1, memory allocation errors with a status of 2, unable to  open  Netlink  socket
       with 3.

SEE ALSO

       iptables(8), ip6tables(8), arptables(8), ebtables(8), ip(8), tc(8)

       There is an official wiki at: http://wiki.nftables.org

AUTHORS

       nftables was written by Patrick McHardy.

COPYRIGHT

       Copyright 2008-2014 Patrick McHardy <kaber@trash.net>

       nftables is free software; you can redistribute it and/or modify it under the terms of the
       GNU General Public License version 2 as published by the Free Software Foundation.

       This documentation is licenced under  the  terms  of  the  Creative  Commons  Attribution-
       ShareAlike 4.0 license, CC BY-SA 4.0 ⟨http://creativecommons.org/licenses/by-sa/4.0/⟩ .

                                         06 November 2015                                  nft(8)