nftables

how do you block a range of ip addresses with nftables? how do you block ip addresses from a dynamic list? with iptables i could do a little loop to read each line and create an iptables rule: `while read line; do iptables -A INPUT -s $line -j DROP; done < file.txt` is there a better way to do this?

Named sets. >avoid rule spam bloat >edit sets on the fly without flushing rules >can do ranges and subnets (if flags interval is enabled for the set) [root@localhost ~]# nft flush ruleset ; nft -f - <<'FWRULES' define gw = 192.168.1.1 define intnets = { 10.100.0.0/24, 100.200.0.0/24 } define http_allowed = { $gw, $intnets, 10.150.0.0/24, 10.250.0.250, 10.2.3.4-10.5.6.6 } table ip filter { set ssh_allowed { type ipv4_addr flags interval elements = { $gw, 172.16.24.32, $intnets, 192.168.224.192/28 } } chain input { type filter hook input priority 0; policy drop; ip saddr $http_allowed tcp dport { 80, 443, 8080, 8443 } counter accept ip saddr @ssh_allowed tcp dport ssh counter accept } } FWRULES

>>25661 >intervals yeah i know... but how do you put hundreds of ips in a set? i think i will just use iptables for this but keep core configuration in nftables...

>>25672 >Unlike anonymous sets, elements can be added to or removed from a named set at any time. for i in 1.1.1.1 8.8.8.8; do # nft add element [ip/ip6] <table> <set> { "$i" } nft add element ip myTable ciaNiggers { "$i" } done You can check if an IP is in your set with nft get element <table> <set> { 10.14.8.8 } , will show if it's part of an interval or subnet too.

>>25675 >elements can be added to or removed from a named set at any time got it thank you!

i dont know what an ntable is imma have to look that up rn

>>25698 >what an ntable is nano troon able. It depicts a deformed kid ranging from 13 to 16, mostly down syndrome, who's able (nicer way of saying not clinically retarded) enough to LARP as a security expert by copy pasting sheets from Theo (mostly the x86 virtualization mail), Madaidan and the grugq. Their habitat usually resides in the now dead nanochan, the lainchan >>>/sec/ and the lambdachan /tech/. Only a fool would take them seriously

>>25698 nftables is to iptables what systemd is to sysvinit >>25699 >It depicts a deformed kid ranging from 13 to 16, mostly down syndrome She was 13 in season 5.