From: Amish V <anon.amish@gmail.com>
To: kfm@plushkava.net
Cc: netfilter@vger.kernel.org
Subject: Re: when will nftables have ability to delete matching rule like iptables?
Date: Tue, 9 Mar 2021 04:16:14 +0530 [thread overview]
Message-ID: <D0655906-0F05-4EDE-AE96-AE153DA2A856@gmail.com> (raw)
In-Reply-To: <0a56115b-e5aa-81a9-2b69-3cd5d11609c9@plushkava.net>
> On 08-Mar-2021, at 8:54 PM, "" <kfm@plushkava.net> <kfm@plushkava.net> wrote:
>
>> On 08/03/2021 13:14, Amish wrote:
>> Hello,
>> I have few programs that currently use iptables to add / delete firewall rules.
>> I have been waiting to migrate to nftables from 3-4 years. (I do not want to use nft based iptables)
>> But roadblock for me is inability of nftables to delete a matching rule. (similart to iptables -D INPUT -s 192.168.1.10 -j ACCEPT)
>> Obtaining the handle first and then deleting is difficult programmatically.
>> Have I missed any easy way out here?
>
> Assuming that "-D INPUT -s 192.168.1.10 -j ACCEPT" is indicative of the rules that are being added and removed, the easy way would be to manipulate a set rather than a chain. That also goes for iptables, given the existence of ipset.
No I have many complex rules. Above was just an example.
When rules are complex parsing the nft output programmatically to find the handle of the rule is not easy.
Regards,
Amish
prev parent reply other threads:[~2021-03-08 22:46 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-08 13:14 when will nftables have ability to delete matching rule like iptables? Amish
2021-03-08 15:24 ` kfm
2021-03-08 22:46 ` Amish V [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=D0655906-0F05-4EDE-AE96-AE153DA2A856@gmail.com \
--to=anon.amish@gmail.com \
--cc=kfm@plushkava.net \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.