A have a weird scenario in which I need to create some firewall-rules to flash a LED. So far, I've always been able to do that using iptables:

iptables -A INPUT -p tcp --dport 443 -j LED --led-trigger-id mytrigger

So far, so good. There is a new issue, however: For various reasons, I now need to create such a rule not in the input-, but rather in an ingress-chain, which I can (AFAIK) only create and manage using nftables. However, I cannot for the life of me figure out how to create LED-rules using nft.

I have taken a look at the output of the rule created by iptables using nft list chain filter INPUT, which yields:

table ip filter {
    chain INPUT {
        type filter hook input priority filter; policy accept;
        tcp dport 443 counter packets 0 bytes 0 # led-trigger-id:"myfirewalltrigger"

This is not helpful. Let's try iptables-translate -A INPUT -p tcp --dport 443 -j LED --led-trigger-id myfirewalltrigger:

nft # -A INPUT -p tcp --dport 443 -j LED --led-trigger-id myfirewalltrigger

This is not helpful either.

How come that nftables seemingly just cannot deal with LED rules?


1 Answer 1


I think you are having this problem because LED is an unsupported extension of iptables that is not now supported in nftables.


That is too bad because it sounds like you are doing something cool. Please revisit this question if you find a workaround (like parsing live logs and triggering on that?)

  • 1
    I would, but unfortunately my solution was to “just not do that”. I intended to use that for a demo which I ended up not doing. Thank you regardless, at least now I know that this is simply a feature not implemented (yet) and have a link where this is documented.
    – Joja
    Commented Dec 15, 2022 at 12:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .