8

I have a number of rules in table mytable chain mychain:

> sudo nft -a list table mytable
table ip mytable { # handle 8
        chain mychain { # handle 1
                type filter hook input priority filter; policy accept;
                tcp dport 5550 accept # handle 18
                tcp dport 5551 accept # handle 19
                tcp dport 5552 accept # handle 20
                tcp dport 5553 accept # handle 21
                tcp dport 5554 accept # handle 22
        }
}

According to nftables wiki it should be possible to remove all rules from the specified chain. However the following command returns error:

> sudo nft delete rule mytable mychain
Error: syntax error, unexpected newline, expecting handle
delete rule mytable mychain
                           ^

What is the proper command to remove all rules from mychain without iterating over rule handles?

1 Answer 1

16

There are still some errors lurking in the nftables wiki. The actual syntax is quite logical:

  • to remove everything

    nft flush ruleset
    
  • to empty a table (with ip as family by default if not specified). Eg for my table

    nft flush table mytable
    
  • to delete a table (which also empties it first). Eg for mytable

    nft delete table mytable
    
  • to empty a chain (ditto). Eg for mytable mychain

    nft flush chain mytable mychain
    
  • to delete a chain (ditto). Eg for mytable mychain

    nft delete chain mytable mychain
    
  • to delete a rule (this can still be done only by the handle reference). Eg for tcp dport 5550 accept # handle 18

    nft delete rule mytable mychain handle 18
    

The thing to remember is what the action is done unto. If you want to do an operation at the chain level, then it's normal there's the chain keyword.

In case of doubt, the nft manpage is usually more accurate, but of course one has to know in advance the information is in the CHAINS section rather than the RULES section:

CHAINS

{add | create} chain [family] table chain [ { type type hook hook [device device] priority priority ; [policy policy ;] } ]
{delete | list | flush} chain [family] table chain
delete chain [family] table handle handle
rename chain [family] table chain newname

[...]
flush Flush all rules of the specified chain.

5
  • It seems not possible to remove more than one handle with one command, even if the rules are part of the same chain
    – Polizi8
    Feb 11, 2021 at 17:24
  • @Polizi8 you can remove all of the chain's rules in one command, as was OP's question about (and as described in bold in my answer).
    – A.B
    Feb 11, 2021 at 18:16
  • @Polizi8 also (I forgot it), nftables can do transactions: you can remove two rules in the same transaction, turning a chain with 5 rules to a chain with 3 rules, never going through the state with 4 rules, in a single transaction. With the -f option of the nft command.
    – A.B
    Apr 10, 2022 at 13:33
  • These commands do not work on the version I am running (v0.9.3). I must include the family in the commands. Example: nft flush chain filter output fails. But nft flush chain inet filter output works.
    – Dave
    Sep 21, 2022 at 17:49
  • 1
    @Dave that's because the default table family is ip which can be omitted, not inet which (represents ip+ip6 and) has to be stated. You have to read between the lines, examples don't always apply. But they did apply to OP's question.
    – A.B
    Sep 21, 2022 at 18:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .