One of the main advantages of nftables to iptables is a "Simplified dual stack IPv4/IPv6 administration, through the new inet family that allows you to register base chains that see both IPv4 and IPv6 traffic." (from the netfilter website)

I'm wondering how you deploy your packetfilter rules on a dual stack LAN, with IPv4 and IPv6. Lets say you want to filter a dual stack system with the addresses and 2003:f9:e101::1. It obviously is possible to have two rules, one for IPv4 and one for IPv6:

nft add rule inet table filter ip6 saddr 2003:f9:e101::1 reject
nft add rule inet table filter ip  saddr reject

But is there any more convenient way to not have separated rules for IPv4 and IPv6?


1 Answer 1


As far as I know it is not possible:

the syntax mixing IPv6/IPv4 notation is not supported yet

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.