Using sets in nftables is really cool. I am currently using a lot of statements like these in my nftables.conf
rulesets:
iifname {clients0, dockernet} oifname wan0 accept comment "Allow clients and Docker containers to reach the internet"
But {clients0, dockernet}
is an anonymous (inline) set of strings. Instead of repetition in the rules over and over, I'd like to define a set of interfaces, called a named set in nftables. The manpage shows how to do that for several types of sets: ipv4_addr, ipv6_addr, ether_addr, inet_proto, inet_service, mark. But, not for interface name or simple primitive type of string.
So, despite I could not find a way how to do that, I've tried this, but this does not work:
Omitting the type:
table inet filter { set myset { elements = { clients0, dockernet, } } [...] }
Result:
Error: set definition does not specify key
.Specify
string
type:table inet filter { type string; set myset { elements = { clients0, dockernet, } } [...] }
Result:
Error: unqualified key type string specified in set definition
.
Is there really no way of naming the anonymous set I've shown on the top?