Re: Moving from ipset to nftables

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 





On 06/01/19 10:14 pm, Mikhail Morfikov wrote:
But still, is there a way to get rid of the set rules from the "nft list ruleset"
output? Because having 100K+ IPs :

# nft list ruleset | wc -l
104153

in the set makes the output really unreadable, and each "nft list" command,
even those that list other tables, takes 5-10s to return some output.

Create a separate table which handles just sets.

nft list ruleset - will list everything.

nft list table foo - will list only the table foo which would not have sets

But you may have to readjust your rules

Amish



[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux