[nftables] is it possible to declare multiple tables for a given family type?
Mathias Dufresne <[email protected]> Sun, 1 Mar 2026 11:12:19 +0100
| Newsgroups | gmane.comp.security.firewalls.netfilter.general |
|---|---|
| Message-ID | <[email protected]> |
Hi everyone,
I'm trying to replace my very old iptables script with nftables and I'm
wondering if it is possible to declare several tables of the same family.
As far as my tests went, it seems it is not or that I did not understand
the ordering of rules...
The goal would be to sort my rules among these tables...
Something like that:
===============================================================================
table ip filter_SSH {
chain ipv4_log_ssh {
counter packets 0 bytes 0 log prefix "Accept ip SVC for
'administrative services/ssh': "
counter packets 0 bytes 0 log prefix "Accept ip SVC for
'administrative services/ssh': " group 2
counter packets 0 bytes 0 accept
}
chain input {
type filter hook input priority filter; policy accept;
iif "eth12" ip daddr 172.16.0.1 tcp dport 22 ct state
new jump ipv4_log_ssh
oif "eth12" ip saddr 172.16.0.1 tcp sport 22 ct state
new jump ipv4_log_ssh
}
chain forward {
type filter hook forward priority filter; policy accept;
iif "eth12" ip daddr 172.16.0.1 tcp dport 22 ct state
new accept
oif "eth12" ip saddr 172.16.0.1 tcp sport 22 ct state
new accept
}
chain output {
type filter hook output priority filter; policy accept;
iif "eth12" ip daddr 172.16.0.1 tcp dport 22 ct state
new accept
oif "eth12" ip saddr 172.16.0.1 tcp sport 22 ct state
new accept
}
}
table ip filter_DNS {
chain ipv4_log_dns {
counter packets 0 bytes 0 log prefix "Accept ip SVC for
'DNS': "
counter packets 0 bytes 0 log prefix "Accept ip SVC for
'DNS': " group 2
counter packets 0 bytes 0 accept
}
chain input {
type filter hook input priority filter; policy accept;
iif "eth12" ip daddr 172.16.0.2 udp dport 53 jump
ipv4_log_dns
oif "eth12" ip saddr 172.16.0.2 udp sport 53 jump
ipv4_log_dns
}
chain forward {
type filter hook forward priority filter; policy accept;
iif "eth12" ip daddr 172.16.0.2 udp dport 53 accept
oif "eth12" ip saddr 172.16.0.2 udp sport 53 accept
}
chain output {
type filter hook output priority filter; policy accept;
iif "eth12" ip daddr 172.16.0.2 udp dport 53 accept
oif "eth12" ip saddr 172.16.0.2 udp sport 53 accept
}
}
table ip ZZZ_accept_related {
chain ipv4_log_drop {
counter packets 0 bytes 0 log prefix "DROP: dropping
everything else"
counter packets 0 bytes 0 log prefix "DROP: dropping
everything else" group 2
counter packets 0 bytes 0 drop
}
chain input {
type filter hook input priority filter; policy accept;
ct state { established, related } counter packets 556
bytes 48604 accept
jump ipv4_log_drop
}
chain forward {
type filter hook forward priority filter; policy accept;
ct state { established, related } counter packets 0
bytes 0 accept
jump ipv4_log_drop
}
chain output {
type filter hook output priority filter; policy accept;
ct state { established, related } counter packets 557
bytes 49124 accept
jump ipv4_log_drop
}
}
===============================================================================
Best regards,
mathias