How do I delete a specific element in a chain in nftables?

Question

Current system:

Distro: Ubuntu 20.04
kernel: 5.4.0-124-generic
nft: nftables v0.9.3 (Topsy)

I am new and learning nftables, Here is my nft ruleset currently:

$sudo nft list ruleset                                                                                                                                                                                           taxmd-dh016d-02: Wed Sep 21 12:09:08 2022

table inet filter {
        chain input {
                type filter hook input priority filter; policy accept;
        }

        chain forward {
                type filter hook forward priority filter; policy accept;
        }

        chain output {
                type filter hook output priority filter; policy accept;
                ip daddr 192.168.0.1 drop
        }
}

I want to delete ip daddr 192.168.0.1 drop from the output chain. I tried the following:

sudo nft del rule inet filter output ip daddr 192.168.0.1 drop
sudo nft delete rule inet filter output ip daddr
sudo nft 'delete element ip daddr 192.168.0.1 drop'
sudo nft 'delete element ip'
sudo nft delete rule filter output ip daddr 192.168.0.1 drop

But nothing works, I keep getting this error:

Error: syntax error, unexpected inet
delete inet filter chain output ip daddr 192.168.0.1 drop
       ^^^^

Why can't I delete a specific element? I would think this would be straight forward, but I am missing something.

meuh · Accepted Answer · 2022-09-21 18:41:07Z

2

The wiki says what you tried is not yet implemented: You have to obtain the handle to delete a rule. The example is:

$ sudo nft -a list table inet filter
table inet filter {
      ...
      chain output {
            type filter hook output priority 0;
            ip daddr 192.168.1.1 counter packets 1 bytes 84 # handle 5
      }
}

The -a shows the assigned handle "5" as a comment, so you can

$ sudo nft delete rule filter output handle 5

edited Sep 21, 2022 at 18:41

answered Sep 21, 2022 at 16:41

meuh

54.7k2 gold badges70 silver badges138 bronze badges

Add a comment |

puchu · Accepted Answer · 2024-05-24 19:01:28Z

Okay, what we have:

sudo nft "add table inet filter"
sudo nft "add chain inet filter output"
sudo nft "add rule inet filter output ip daddr 192.168.0.1 drop"

We want to delete the rule, that we have just added. The reliable command will be the following:

sudo nft --json --handle list ruleset |
  jq -r '
    .nftables |
    map(
      select(.rule != null) |
      .rule |
      select(
        .family == "inet" and
        .table == "filter" and
        .chain == "output" and
        .expr != null and
        .handle != null
      ) |
      select(
        (.expr | map(
          select(.match != null) |
          .match |
          select(
            .left.payload.protocol == "ip" and
            .left.payload.field == "daddr" and
            .op == "==" and
            .right == "192.168.0.1"
          )
        ) | length > 0) and
        (.expr | map(select(has("drop"))) | length > 0)
      ) |
      .handle
    )[]
  ' |
  xargs -I {} sudo nft "delete rule inet filter output handle {}"

This command has almost the maximum syntax sugar that jq can provide. Despite that, it looks enormous. However, Redhat is forcing everyone on this planet to move from well designed iptables to nftables. It is only your choice: dance around jq or keep iptables as is.

Stack Exchange Network

How do I delete a specific element in a chain in nftables?

2 Answers 2

You must log in to answer this question.

Hot Network Questions

How do I delete a specific element in a chain in nftables?

2 Answers 2

You must log in to answer this question.

Related

Hot Network Questions