2a1b69db00
The old rule would result in nftables failing to load if the iface doesn't exist. Using `iifname` will match on any future ifaces if they don't exist when the firewall starts.
11 lines
356 B
Text
11 lines
356 B
Text
#!/usr/sbin/nft -f
|
|
table inet filter {
|
|
chain input {
|
|
iifname "anbox*" accept comment "Allow incoming network traffic from Anbox"
|
|
}
|
|
chain forward {
|
|
iifname "anbox*" accept comment "Allow outgoing network traffic from Anbox"
|
|
ct state {established, related} counter accept comment "accept established connections"
|
|
}
|
|
}
|
|
|