Sample Header Ad - 728x90

How do I create a named set of interfaces by name in nftables?

4 votes
2 answers
5378 views
Using sets in nftables is really cool. I am currently using a lot of statements like these in my nftables.conf rulesets: iifname {clients0, dockernet} oifname wan0 accept \ comment "Allow clients and Docker containers to reach the internet" In the rule above {clients0, dockernet} is an *anonymous* (inline) set of interfaces. Instead of repetition in the rules over and over, I'd like to define a set of interfaces at the top of the file, called a *named set* in nftables. The manpage (Debian Buster) shows how to do that for several types of sets: *ipv4_addr*, *ipv6_addr*, *ether_addr*, *inet_proto*, *inet_service* and *mark*. However, it seems it's not available for interfaces by name or simple primitive type such as strings. I've the approach below, but this does not work with the errors given: 1. Omitting the type:
table inet filter {
      set myset {
        elements = {
          clients0,
          dockernet,           
        }
      }
      [...]
    }
Result: Error: set definition does not specify key. 1. Using the string type:
table inet filter {
      type string;
      set myset {
        elements = {
          clients0,
          dockernet,           
        }
      }
      [...]
    }
Result: Error: unqualified key type string specified in set definition. Is there really no way of naming the anonymous set I've shown on the top?
Asked by gertvdijk (14517 rep)
May 5, 2019, 11:01 AM
Last activity: Jun 26, 2025, 01:07 PM