Nftables

nftables superseeds iptables and related programs and should be used for new deployments of Linux based systems.

Documentation

• nftables sets
• Simple rule management

Sets

table inet filter {

       # adding:   nft add element inet filter privileged_hosts { 1.2.3.4 }
       # removing: nft delete element inet filter privileged_hosts { 1.2.3.4 }
       set privileged_hosts {
               type ipv4_addr
               flags interval
               elements = { 1.2.3.5 }
       }
       
       set tcp_ports_always_allowed {
               type inet_service
               flags interval
               elements = { 80, 443 }
       }
       
       set tcp_ports_privileged {
               type inet_service
               flags interval
               elements = { 22 }
       }
       
       chain input {
               type filter hook input priority 0; policy drop;
               ct state established,related accept
               ct state invalid drop

               # loopback interface
               iifname lo accept
               iifname lxcbr0 accept

               tcp dport @tcp_ports_always_allowed accept
               tcp dport @tcp_ports_privileged ip saddr @privileged_hosts accept
               tcp dport @tcp_ports_always_allowed ip6 saddr $allow_ip6s accept
       }

       chain forward {
               type filter hook forward priority 0; policy accept;
       }
       chain output {
               type filter hook output priority 0; policy accept;
       }

}

"flags interval" enables adding multiple elements, like subnets (127.0.0.0/8) or port ranges (8080-8099).