nftables stores firewall rules in tables. Each table belongs to a family (such as inet, ip, or ip6) and contains one or more chains. Chains contain rules, and each rule is a sequence of tests (matches) followed by an action like accept, drop, jump, or log. Named sets can group addresses or services for reuse in multiple rules.
-Rules are stored in the system's own nftables configuration file — /etc/nftables.conf or /etc/sysconfig/nftables.conf, whichever the nftables service loads on this system. Anything already in that file, such as comments, define variables and include lines, is left alone. The nftables service loads that file at boot, so rules saved here survive a reboot in the same way as rules written by hand.
+Rules are stored in the system's nftables configuration file — /etc/nftables.conf or /etc/sysconfig/nftables.conf, whichever the nftables service loads on this system. Anything already in that file, such as comments, define variables and include lines, is left alone. The nftables service loads that file at boot, so rules saved here survive a reboot in the same way as rules written by hand.
To get started, use the Setup page to create a default ruleset, or create a table and chain manually. Then add rules (and sets) from the table view. When you are ready to activate your changes, click Apply Configuration to load the ruleset into the kernel.
diff --git a/nftables/t/run-tests.t b/nftables/t/run-tests.t index 2d017b14d..0ee094f9c 100755 --- a/nftables/t/run-tests.t +++ b/nftables/t/run-tests.t @@ -493,7 +493,7 @@ ok(scalar(grep { $_ eq '2022' } @{$profile_table->{sets}->{profile_hosting_tcp_ports}->{elements}}), 'profile helper includes dynamic ssh port'); -# The saved configuration is now the system's own nftables file, so re-writing +# The saved configuration is the system's own nftables file, so re-writing # it must not discard anything the module does not model my $sysfile = write_ruleset($confdir, 'system.nft', <<'EOF'); #!/usr/sbin/nft -f