New answers tagged


You should create the new element before you delete the old one. That way there is always a set to match, no lost packets because of a firewall update. The short gap would probably not cause any problems but there is no reason not to do it this way.


A variant of this problem was addressed recently in Kubernetes, so it’s worth looking at what was done there. (The variant is whether to use iptables-legacy or iptables-nft and their IPv6 variants to drive the host’s rules.) The approach taken in Kubernetes is to look at the number of lines output by the respective “save” commands, iptables-legacy-save and ...


try this one table inet filter { set blackhole_4 { type ipv4_addr flags timeout } set blackhole_6 { type ipv6_addr flags timeout } set greed_4 { type ipv4_addr flags dynamic size 128000 } set greed_6 { type ipv6_addr flags dynamic size 128000 } chain input { type filter hook input priority 0; ...

Top 50 recent answers are included