Hello Maurice!

04 Dec 2017 06:08, Maurice Kinal wrote to Nicholas Boel:

 MK> 4.13.x kernels are better than 4.12.x kernels methinks, but both are 
 MK> EOL.  Howver 4.13.16 is definetly better than 4.9.x kernels, which is 
 MK> the latest longterm kernel, or at least the last one I compared 
 MK> 4.13.16 to which was 4.9.65.

so lets help me getting nftables to work :=)

   ----- ipv4-filter begins -----
#! /sbin/nft -f

table filter {
        chain input {
                type filter hook input priority 0;
                ct state established accept
                ct state related accept
                meta iif lo accept
                tcp dport ssh counter packets 0 bytes 0 accept
                tcp dport binkp counter packets 0 bytes 0 accept
                tcp dport tfido counter packets 0 bytes 0 accept
                tcp dport fido counter packets 0 bytes 0 accept
                counter packets 5 bytes 5 log drop
        }
        chain forward { type filter hook forward priority 0; }
        chain output {
                type filter hook output priority 0;
                ct state established accept
                ct state related accept
                meta iif lo accept
                ct state new counter packets 0 bytes 0 accept
        }
}
   ----- ipv4-filter ends -----

i dont know if its works or not :(

current is not enabled yet, can some help me make it better ?

or even working ? :=)

one error i have with it is that tfido is a unknown service to nft ?


 Regards Benny

... there can only be one way of life, and it works :)

--- Msged/LNX 6.2.0 (Linux/4.14.3-gentoo (i686))