How do I create a named set of interfaces by name in nftables?
4
votes
2
answers
5378
views
Using sets in nftables is really cool. I am currently using a lot of statements like these in my
nftables.conf
rulesets:
iifname {clients0, dockernet} oifname wan0 accept \
comment "Allow clients and Docker containers to reach the internet"
In the rule above {clients0, dockernet}
is an *anonymous* (inline) set of interfaces. Instead of repetition in the rules over and over, I'd like to define a set of interfaces at the top of the file, called a *named set* in nftables. The manpage (Debian Buster) shows how to do that for several types of sets: *ipv4_addr*, *ipv6_addr*, *ether_addr*, *inet_proto*, *inet_service* and *mark*. However, it seems it's not available for interfaces by name or simple primitive type such as strings.
I've the approach below, but this does not work with the errors given:
1. Omitting the type:
table inet filter {
set myset {
elements = {
clients0,
dockernet,
}
}
[...]
}
Result: Error: set definition does not specify key
.
1. Using the string
type:
table inet filter {
type string;
set myset {
elements = {
clients0,
dockernet,
}
}
[...]
}
Result: Error: unqualified key type string specified in set definition
.
Is there really no way of naming the anonymous set I've shown on the top?
Asked by gertvdijk
(14517 rep)
May 5, 2019, 11:01 AM
Last activity: Jun 26, 2025, 01:07 PM
Last activity: Jun 26, 2025, 01:07 PM