Using iptables is it possible to block fragmented packets with this rule:

iptables -A INPUT -f -j DROP

But there isn't a equivalent in nftables. There is any way to do it?

  • 2
    For my own curiosity: why do you want to drop them? Apr 22, 2016 at 12:50
  • Most likely to see what breaks and watch the fires burn... Nov 14, 2016 at 2:50

2 Answers 2


From Nftables Wiki or just man nft you can use ip frag-off. Now (after a few trials and errors) the 3 flags (reserved, DF, MF) are included in this value at the 3 highest bits and have to be excluded from the test, needing a & operation. So this:

nft 'add rule ip filter input ip frag-off & 0x1fff != 0 drop'

Would do it...

... but when nf_conntrack_ipv4 is loaded (almost always), its specific nf_defrag_ipv4 part registers at hook priority -400, and will reassemble all fragments. That means any processing after won't see any fragment. So your chain has to hook with a priority value lower than that. Here's a complete working example:

nft add table filter
nft 'add chain filter predefrag { type filter hook prerouting priority -450; }'
nft 'add rule ip filter predefrag ip frag-off & 0x1fff != 0 drop'

Arguably the 1st packet is also a fragment with offset 0 but with MF set. So maybe 0x1fff should be replaced with 0x3fff to catch it.



iptables-translate -A INPUT -f -j DROP


nft add rule ip filter INPUT ip frag-off != 0 counter drop

iptables-translate comme from (on debian Debian 4.9.82-1+deb9u3 (2018-03-02) x86_64 GNU/Linux:

apt install iptables-nftables-compat


or nft 'add rule inet filter input ip frag-off 0x4000 counter accept'

  • today's result of iptables-translate is different (meaning the older translation was wrong): iptables-translate -A INPUT -f -j DROP => nft add rule ip filter INPUT ip frag-off & 0x1fff != 0 counter drop which is what I wrote 1y1/2 before.
    – A.B
    Aug 11, 2020 at 10:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.