netfilter.vger.kernel.org archive mirror
 help / color / mirror / Atom feed

From: "Aurel Wisse" <nf@awisse.ca>
To: netfilter@vger.kernel.org
Subject: nftables expressions and operators
Date: Mon, 06 Nov 2023 08:11:09 -0500	[thread overview]
Message-ID: <74e3c950-e623-4b46-9186-8fe2230c9f9a@app.fastmail.com> (raw)

Hi,

I am starting to learn nftables (only superficial previous experience with iptables) and I can't find certain syntax rules for expressions and operators in the wiki or the man page.

I am learning by listing the rulesets of certain predefined firewalls (fw4/OpenWRT, UFW) and I notice that certain listed rules contain operators which I can guess (hopefully correctly) from context and the original syntax in the imported file, but I would like to be sure in order not to make mistakes while building my own firewall.

Examples:

tcp flags & (fin|syn|rst|ack) != syn jump syn_flood

becomes

tcp flags syn / fin,syn,rst,ack jump syn_flood 

So, from context, commas without spaces around them are equivalent to logical or with precedence over "/", and "/" is somehow "!=" ?? . Where did the & (logical AND?) operator go?

This is just one example. I would like to learn the full operator syntax rules in nftables. Any ideas where I should look ? Do I have to dig into the source code ?

Thanks

Aurel

nftables v1.0.2 (Lester Gooch)
Pop-OS (6.5.6-76060506-generic)

next             reply	other threads:[~2023-11-06 13:11 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-11-06 13:11 Aurel Wisse [this message]
2023-11-06 13:28 ` nftables expressions and operators Pablo Neira Ayuso
2023-11-06 14:24   ` Aurel Wisse
2023-11-06 15:28     ` Eric
2023-11-06 15:41       ` Aurel Wisse

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=74e3c950-e623-4b46-9186-8fe2230c9f9a@app.fastmail.com \
    --to=nf@awisse.ca \
    --cc=netfilter@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).