diff options
authorPhil Sutter <>2018-11-12 15:02:52 +0100
committerPablo Neira Ayuso <>2018-11-12 16:35:18 +0100
commitf4e40e395af2b73cd72c5454e41fb879da8c5f61 (patch)
parent2892dc4f5d9e8472f3b6f2f8915c9da63a730062 (diff)
nft.8: Clarify 'index' option of add rule command
Documentation for add rule command might trick readers into believing the optional 'index' argument does not need to be that of an existing rule. This false assumption is fueled by the fact that iptables allows to insert with last rule number + 1 to actually append to a chain. Change the relevant sentence to clarify that. While being at it, drop the deprecated 'position' option from documentation - since this will likely go away at some point, don't encourage users to use it although they should notice that they shoudn't. Signed-off-by: Phil Sutter <> Signed-off-by: Pablo Neira Ayuso <>
1 files changed, 2 insertions, 4 deletions
diff --git a/doc/nft.txt b/doc/nft.txt
index 030e67e9..fca91450 100644
--- a/doc/nft.txt
+++ b/doc/nft.txt
@@ -404,7 +404,7 @@ values are *accept* (which is the default) or *drop*.
-{add | insert} *rule* ['family'] 'table' 'chain' [ {handle | position} 'handle' | index 'index' ] 'statement' ... [ comment 'comment' ]
+{add | insert} *rule* ['family'] 'table' 'chain' [ handle 'handle' | index 'index' ] 'statement' ... [ comment 'comment' ]
replace *rule* ['family'] 'table' 'chain' handle 'handle' 'statement' ... [ comment 'comment' ]
delete *rule* ['family'] 'table' 'chain' handle 'handle'
@@ -413,15 +413,13 @@ ip family is used. Rules are constructed from two kinds of components according
to a set of grammatical rules: expressions and statements.
The add and insert commands support an optional location specifier, which is
-either a 'handle' of an existing rule or an 'index' (starting at zero).
+either a 'handle' or the 'index' (starting at zero) of an existing rule.
Internally, rule locations are always identified by 'handle' and the translation
from 'index' happens in userspace. This has two potential implications in case a
concurrent ruleset change happens after the translation was done: The effective
rule index might change if a rule was inserted or deleted before the referred
one. If the referred rule was deleted, the command is rejected by the kernel
just as if an invalid 'handle' was given.
-The old name "position" in place of "handle" is deprecated
-and should not be used anymore.
A 'comment' is a single word or a double-quoted (") multi-word string which can
be used to make notes regarding the actual rule. *Note:* If you use bash for