nftables setting

last update 2025/10/20

setting

overview

configure access permissions to the VPN port on the server and routing to wg0 using nftables.

setup

config

config

/etc/sysconfig/nftables.conf

flush ruleset

table ip filter {
   chain INPUT {
      type filter hook input priority 0; policy drop;

      ct state established,related counter accept
      ct state new udp dport 51820 ip saddr @country_accept counter accept
   }
   chain FORWARD {
      type filter hook forward priority 0; policy accept;
      iifname "wg0" accept;
      tcp flags syn tcp option maxseg size set 1240;
   }
   chain OUTPUT {
      type filter hook output priority 0; policy accept;
   }
}
table ip nat {
   chain prerouting {
      type nat hook prerouting priority 0;
   }
   chain postrouting {
      type nat hook postrouting priority 0;
   ip saddr 172.16.0.0/24 oifname "<nic>" masquerade;
   }
}

start nftables

systemctl enable nftables
systemctl start nftables