I used to have an iptables rule that would allow wireguard traffic to pass:

from ferm:

proto udp dport 51820 mod owner ! uid-owner 0-4294967294 mod conntrack     ctstate (NEW) ACCEPT;

using the translation tool this became:

 udp dport 51820 meta skuid != 0-4294967294 ct state new accept

yet when I look at the counters and logged packets this rule isn't being hit.

How to do this using nftables?

  • You should give the whole ruleset rather than an isolated rule without context.
    – A.B
    Apr 8, 2023 at 9:41
  • Well that rule is being missed because there is a log for all packets after it Apr 8, 2023 at 9:45
  • Yeah nfttables from the kernel. no go. Apr 8, 2023 at 9:48
  • Can't figure this out without the context (network settings, wireguard settings, full nftables ruleset).
    – A.B
    Apr 8, 2023 at 9:50

1 Answer 1


If you mean how do you do something like this: https://superuser.com/questions/1579741/iptables-rule-for-filtering-wireguard-packets in nftables then you cannot add a rule that excludes the entire 32 bit range as you would in iptables.

in nftables you need two rules. The first to drop the entire 32 bit uid range and a second to accept port 51820 (as there is no uid).

chain wireguard_enable {
        udp dport 51820 meta skuid { 0-4294967294 } ct state new drop
        udp dport 51820 ct state new accept


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .