0

I'm a bit frustrated by the lack of comprehensive documentation of nftables and currently I'm failing to get even a simple example to work. I'm trying just create a output rule. Here's my only table:

root@localhost ~ # nft list ruleset
table inet filter {
    chain output {
        type filter hook output priority 0; policy accept;
    }
}

I wish to count the number of packets sent to 8.8.8.8. So I used the example command from the nftables wiki (https://wiki.nftables.org/wiki-nftables/index.php/Simple_rule_management):

root@localhost ~ # nft add rule filter output ip daddr 8.8.8.8 counter                       
Error: Could not process rule: No such file or directory
add rule filter output ip daddr 8.8.8.8 counter
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

But for some reason, I get very uninformative error message. What am I doing wrong and what is the correct way to add an output rule?

root@localhost ~ # uname -a                                                                    
Linux localhost 4.15.3-2-ARCH #1 SMP PREEMPT Thu Feb 15 00:13:49 UTC 2018 x86_64 GNU/Linux
root@localhost ~ # nft --version
nftables v0.8.2 (Joe Btfsplk)
root@localhost ~ # lsmod|grep '^nf'                                                          
nfnetlink_queue        28672  0
nfnetlink_log          20480  0
nf_nat_masquerade_ipv6    16384  1 ip6t_MASQUERADE
nf_nat_ipv6            16384  1 ip6table_nat
nf_nat_masquerade_ipv4    16384  1 ipt_MASQUERADE
nf_nat_ipv4            16384  1 iptable_nat
nf_nat                 36864  4 nf_nat_masquerade_ipv6,nf_nat_ipv6,nf_nat_masquerade_ipv4,nf_nat_ipv4
nft_reject_inet        16384  0
nf_reject_ipv4         16384  1 nft_reject_inet
nf_reject_ipv6         16384  1 nft_reject_inet
nft_reject             16384  1 nft_reject_inet
nft_meta               16384  0
nf_conntrack_ipv6      16384  2
nf_defrag_ipv6         36864  1 nf_conntrack_ipv6
nf_conntrack_ipv4      16384  2
nf_defrag_ipv4         16384  1 nf_conntrack_ipv4
nft_ct                 20480  0
nf_conntrack          155648  10 nft_ct,nf_conntrack_ipv6,nf_conntrack_ipv4,ipt_MASQUERADE,nf_nat_masquerade_ipv6,nf_nat_ipv6,nf_nat_masquerade_ipv4,ip6t_MASQUERADE,nf_nat_ipv4,nf_nat
nft_set_bitmap         16384  0
nft_set_hash           28672  0
nft_set_rbtree         16384  0
nf_tables_inet         16384  2
nf_tables_ipv6         16384  1 nf_tables_inet
nf_tables_ipv4         16384  1 nf_tables_inet
nf_tables             106496  10 nft_ct,nft_set_bitmap,nft_reject,nft_set_hash,nf_tables_ipv6,nf_tables_ipv4,nft_reject_inet,nft_meta,nft_set_rbtree,nf_tables_inet
nfnetlink              16384  3 nfnetlink_log,nfnetlink_queue,nf_tables
1

The correct command is

root@localhost ~ # nft add rule inet filter output ip daddr 8.8.8.8 counter                       

Notice the inet prefix before the table name (filter). That's the table's family type. It's optional, but if you omit it, nft assumes ip (= IPv4), but I'm using inet pseudo-family (both IPv4 and IPv6).

I learned this thanks to the people in the #netfilter channel on Freenode.

Needless to say that nft error messages are anything but helpful. :-)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.