From d20fbc6e5a7b3ec89050e67d1aa0a15f770b7a58 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 10 Aug 2017 19:29:19 +0200 Subject: nft.8: Describe base chain details This mostly covers base chain types, but also tries to clarify meaning of priority values, chain policy and the ominous device parameter. Command synopsis is adjusted as well to point out which parts of a base chain definition are optional and which are not. Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso --- doc/nft.xml | 94 +++++++++++++++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 85 insertions(+), 9 deletions(-) (limited to 'doc/nft.xml') diff --git a/doc/nft.xml b/doc/nft.xml index c9eb48cf..0e795e3c 100644 --- a/doc/nft.xml +++ b/doc/nft.xml @@ -626,20 +626,26 @@ filter input iif $int_ifs accept Chains - add + + add + create + chain family - table - chain - hook - priority - policy - device + table + chain + + + type + hook + device + priority + + policy + - add - create delete list flush @@ -720,6 +726,76 @@ filter input iif $int_ifs accept + + + For base chains, type, hook and priority parameters are mandatory. + + + + Supported chain types + + + + + + + + Type + Families + Hooks + Description + + + + + filter + all + all + Standard chain type to use in doubt. + + + nat + ip, ip6 + prerouting, input, output, postrouting + Chains of this type perform Native Address Translation based on conntrack entries. Only the first packet of a connection actually traverses this chain - its rules usually define details of the created conntrack entry (NAT statements for instance). + + + route + ip, ip6 + output + If a packet has traversed a chain of this + type and is about to be accepted, a new route + lookup is performed if relevant parts of the IP + header have changed. This allows to e.g. + implement policy routing selectors in + nftables. + + + +
+ + + Apart from the special cases illustrated above (e.g. nat type not supporting forward hook or route type only supporting output hook), there are two further quirks worth noticing: + + + netdev family supports merely a single + combination, namely filter type and + ingress hook. Base chains in this family also require the device parameter to be present since they exist per incoming interface only. + + + arp family supports only + input and output + hooks, both in chains of type + filter. + + + + + The priority parameter accepts a signed integer value which specifies the order in which chains with same hook value are traversed. The ordering is ascending, i.e. lower priority values have precedence over higher ones. + + + Base chains also allow to set the chain's policy, i.e. what happens to packets not explicitly accepted or refused in contained rules. Supported policy values are accept (which is the default) or drop. + -- cgit v1.2.3