2

As it is said, this command failed :

nft 'add set netdev blacklist blocklist_v4 {type ipv4_addr; flags interval;}'

But this one succeded :

nft 'add set netdev blacklist blocklist_v4 {type ipv4_addr;}'

I tried with flags constant, and it works. So it seems "interval" is not supported, or am i missing something ??

I'm trying to achieve something like this.

Francois
  • 81
  • 1
  • 7

1 Answers1

5

Don't migrate to nftables until you have kernel 5.6 if you want to have IP intervals ! As it is said here and SHOULD have been wrote here

NOTE: before Linux kernel 5.6 and nftables 0.9.4 the CIDR notation wasn't available, you would need to use a workaround:

No, thanks, fed up with horrible "workarounds". Iptables was able to do that before, and i hate regression. So I will remove CIDR IPs and wrote each IP. Marvelous.

They didn't mention in the right place that flags interval doesn't work under kernel 5.6. and then you get screwed. Ok, fine. Problem "solved".

Francois
  • 81
  • 1
  • 7
  • example of workaround: `ip saddr and 255.0.0.0 { 0.0.0.0, 10.0.0.0, 127.0.0.0 } drop` drops all with source address 0.0.0.0/8, 10.0.0.0/8, 127.0.0.0/8. – Alex Jun 13 '23 at 23:40