Thomas <tad1073@xxxxxxxxx> wrote: > Is it possible for a one-liner like so? > iif eth0 saddr 1.2.3.4 ct direction original ct state { established, > related } ct status { seen-reply, assured, confirmed } accept Yes, ct is not special. You might want to omit the { } in this case though. foo { bar, baz } matches only if foo is bar or baz. For bitmask types, you probably want to match if any of the flags is set. see "nft describe ct status".