In iptables it was possible to use eth+ as interface name to match any interface starting with eth (or as a more practical example this also worked to match virbr+ and veth+, i.e. the + seemed to have the effect of a * in shell globs).

Does nftables offer a similar facility to match interface names? How do I use it?


Yes the usual wildcard character * is nft's equivalent of iptables' +. The man page was not documenting this (relatively old) feature until recently.

From a recent enough nft man page:

Like with iptables, wildcard matching on interface name prefixes is available for iifname and oifname matches by appending an asterisk (*) character. Note however that unlike iptables, nftables does not accept interface names consisting of the wildcard character only - users are supposed to just skip those always matching expressions. In order to match on literal asterisk character, one may escape it using backslash (\).


iifname "veth*" accept

Also, it doesn't appear possible today to use a set of interfaces (type ifname or typeof iifname) with a wildcard in an element.

A completely different method to manage interfaces dynamically appearing and disappearing, would be to tag them with a group just after they are created (and probably before they are brought up) and have nftables rules matching an interface's group. eg:

ip link set ppp7 group 42

while having an nftables rule reusing this meta information:

iifgroup 42 jump from-ppp
  • Thanks so much. Yes, sets were my plan B in case there was no wildcard option. – 0xC0000022L Aug 29 '20 at 19:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.