Rules¶
Rules define what should happen with the trafiic matched by the zones.
Each rule has a list of from zones and to zones.
A rule only gets applied, if the traffic in question originated in one of the from zones and is heading to one of the to zones.
If matched, the rule can define ports to open, a terminating verdict or any custom nft rules by using extraLines.
Rules are applied from most specific to least specific, traversing the from side before the to side.
To allow for more complex setups (mostly custom drop/reject rules) rules are applied in multipe passes.
Each rule has a ruleType.
Rules are gruped by their type and applied in these groups, so that all rules are applied for the first type, before rules of the next type are taken into consideration.
Options¶
networking.nftables.firewall.rules¶
networking.nftables.firewall.rules
This option has no description.
attribute set of (submodule)
{ }
networking.nftables.firewall.rules.<name>.after¶
networking.nftables.firewall.rules.<name>.after
This option has no description.
non-empty (list of string)
networking.nftables.firewall.rules.<name>.allowedTCPPortRanges¶
networking.nftables.firewall.rules.<name>.allowedTCPPortRanges
This option has no description.
list of (submodule)
[ ]
[ { from = 1337; to = 1347; } ]
networking.nftables.firewall.rules.<name>.allowedTCPPortRanges.*.from¶
networking.nftables.firewall.rules.<name>.allowedTCPPortRanges.*.from
This option has no description.
16 bit unsigned integer; between 0 and 65535 (both inclusive)
networking.nftables.firewall.rules.<name>.allowedTCPPortRanges.*.to¶
networking.nftables.firewall.rules.<name>.allowedTCPPortRanges.*.to
This option has no description.
16 bit unsigned integer; between 0 and 65535 (both inclusive)
networking.nftables.firewall.rules.<name>.allowedTCPPorts¶
networking.nftables.firewall.rules.<name>.allowedTCPPorts
This option has no description.
list of signed integer
[ ]
networking.nftables.firewall.rules.<name>.allowedUDPPortRanges¶
networking.nftables.firewall.rules.<name>.allowedUDPPortRanges
This option has no description.
list of (submodule)
[ ]
[ { from = 55000; to = 56000; } ]
networking.nftables.firewall.rules.<name>.allowedUDPPortRanges.*.from¶
networking.nftables.firewall.rules.<name>.allowedUDPPortRanges.*.from
This option has no description.
16 bit unsigned integer; between 0 and 65535 (both inclusive)
networking.nftables.firewall.rules.<name>.allowedUDPPortRanges.*.to¶
networking.nftables.firewall.rules.<name>.allowedUDPPortRanges.*.to
This option has no description.
16 bit unsigned integer; between 0 and 65535 (both inclusive)
networking.nftables.firewall.rules.<name>.allowedUDPPorts¶
networking.nftables.firewall.rules.<name>.allowedUDPPorts
This option has no description.
list of signed integer
[ ]
networking.nftables.firewall.rules.<name>.before¶
networking.nftables.firewall.rules.<name>.before
This option has no description.
non-empty (list of string)
networking.nftables.firewall.rules.<name>.early¶
networking.nftables.firewall.rules.<name>.early
This option has no description.
boolean
false
networking.nftables.firewall.rules.<name>.enable¶
networking.nftables.firewall.rules.<name>.enable
This option has no description.
boolean
true
networking.nftables.firewall.rules.<name>.extraLines¶
networking.nftables.firewall.rules.<name>.extraLines
This option has no description.
list of string
[ ]
networking.nftables.firewall.rules.<name>.from¶
networking.nftables.firewall.rules.<name>.from
This option has no description.
value "all" (singular enum) or list of string
networking.nftables.firewall.rules.<name>.ignoreEmptyRule¶
networking.nftables.firewall.rules.<name>.ignoreEmptyRule
Usually rules without effect will fail the build. Enable this switch to suppress the check for this rule.
boolean
false
networking.nftables.firewall.rules.<name>.late¶
networking.nftables.firewall.rules.<name>.late
This option has no description.
boolean
false
networking.nftables.firewall.rules.<name>.ruleType¶
networking.nftables.firewall.rules.<name>.ruleType
The type of the rule specifies when rules are applied.
The rules are applied in the following order:
ban then rule then policy
Usually most rules are of the type rule, the other types are mostly
intended to specify special drop/reject rules.
one of "ban", "rule", "policy"
"rule"
networking.nftables.firewall.rules.<name>.to¶
networking.nftables.firewall.rules.<name>.to
This option has no description.
value "all" (singular enum) or list of string
networking.nftables.firewall.rules.<name>.verdict¶
networking.nftables.firewall.rules.<name>.verdict
This option has no description.
null or one of "accept", "drop", "reject"
null