Search code examples
nftables

How do I specify a subnet mask when adding a rule in nftables?


How does one specify the subnet mask when adding a rule in nftables?

A slash immediately following the specified ip address results in a syntax error.

nft add rule ip filter input 0.0.0.0/24 drop

results in

Error: syntax error, unexpected /

(OS: Debian Buster: nftables v0.9.0)


Solution

  • Your syntax isn't quite right. You are missing "ip saddr" after input.

    nft add rule ip filter input ip saddr 0.0.0.0/24 drop