Loading Configurations from a File
To load an nftable
ruleset, table, or chain from a file into memory, you can
perform this task manually or automatically when rebooting a system.
To manually load an
nftables
file, do the following:
- Before loading a new configuration from a file, drop the existing
tables:
sudo nft flush ruleset
Note:
This step is crucial to avoid conflicts between the new and old configurations and ensures a clean and consistent application of the new rules. -
Run the following command to load the file into memory:
sudo nft -f /etc/nftables/<import_file_name>.nft
In the previous, <import_file_name> is the name of the file with the information to be imported. This file might contain a ruleset, one or more tables, one or more chains within a table, and any associated rules.Note:
The atomic reload is annftables
feature that ensures that connection tracking is preserved during rule reloading, providing a seamless transition to the new configuration. -
List a ruleset to verify that the file imported correctly:
sudo nft list rulesets
To automatically load a ruleset from a file when restarting the system, do the following:
-
Edit the
/etc/sysconfig/nftables.conf
file to include the .nft table files you want to include at startup. If this file doesn't exist, create it. For example, the following shows that the/etc/sysconfig/nftables.conf
now includes the exported/etc/nftables/myruleset.nft
file.# Uncomment the include statement here to load the default config sample # in /etc/nftables for nftables service. include "/etc/nftables/myruleset.nft" # To customize, either edit the samples in /etc/nftables, append further # commands to the end of this file or overwrite it after first service # start by calling: 'nft list ruleset >/etc/sysconfig/nftables.conf'.
-
Enable and start the
nftables
service:sudo systemctl enable --now nftables