On Thu, Aug 13, 2020 at 12:50:54PM +0000, Andreas Hoefler wrote: > Hi > > Thx for the quick reply. Forgot to mention I am using NFTables...but I guess this should be then possible as well. > > Thx > Andy > > Am 13.08.20 um 14:28 schrieb Andreas Hoefler: > > I have a chain with default policy drop. > > I would like to first have the default policy set to accept, then add rules and later change it to drop. > > Is this possible? > > iptables -t <table> -P <CHAIN> ACCEPT > iptables -t <table> -P <CHAIN> DROP Hi Andy, If you are using individual nft commands then yes, you can do that. But there is no need to do it if using an nft script (#!/usr/sbin/nft -f), since nothing is sent to the kernel until the script is all done, and then the kernel makes all the changes atomically (i.e. all processes are locked out until all the changes are done). Cheers ... Duncan.
