2

Current system:

  • Distro: Ubuntu 20.04
  • kernel: 5.4.0-124-generic
  • nft: nftables v0.9.3 (Topsy)

I am new and learning nftables, Here is my nft ruleset currently:

$sudo nft list ruleset                                                                                                                                                                                           taxmd-dh016d-02: Wed Sep 21 12:09:08 2022

table inet filter {
        chain input {
                type filter hook input priority filter; policy accept;
        }

        chain forward {
                type filter hook forward priority filter; policy accept;
        }

        chain output {
                type filter hook output priority filter; policy accept;
                ip daddr 192.168.0.1 drop
        }
}

I want to delete ip daddr 192.168.0.1 drop from the output chain. I tried the following:

sudo nft del rule inet filter output ip daddr 192.168.0.1 drop
sudo nft delete rule inet filter output ip daddr
sudo nft 'delete element ip daddr 192.168.0.1 drop'
sudo nft 'delete element ip'
sudo nft delete rule filter output ip daddr 192.168.0.1 drop

But nothing works, I keep getting this error:

Error: syntax error, unexpected inet
delete inet filter chain output ip daddr 192.168.0.1 drop
       ^^^^

Why can't I delete a specific element? I would think this would be straight forward, but I am missing something.

1 Answer 1

1

The wiki says what you tried is not yet implemented: You have to obtain the handle to delete a rule. The example is:

$ sudo nft -a list table inet filter
table inet filter {
      ...
      chain output {
            type filter hook output priority 0;
            ip daddr 192.168.1.1 counter packets 1 bytes 84 # handle 5
      }
}

The -a shows the assigned handle "5" as a comment, so you can

$ sudo nft delete rule filter output handle 5
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .