How To: Whitelist An IP Address In 'nftables'

Most Modern Linux distributions will use nftables as the default firewall, though they may have a more end-user friendly interface with it, such as UFW.

Here are the commands to whitelist an IP address on your Linux server, both incoming and outgoing.

Example: How to whitelist IP address 192.168.0.1

Step 1: Log into the server via SSH.

Step 2: Allow incoming connections from 192.168.0.1

# nft insert rule inet filter input ip saddr 192.168.0.1 accept

Note: We use insert instead of add for these rules to ensure it is placed a the top of the input. add puts them at the bottom instead and is useful for deny rules.

Step 3: Allow outgoing connections to 192.168.0.1

# nft insert rule inet filter output ip daddr 192.168.0.1 accept

Additional Options:

If you have multiple IPs assigned, you can specify an allow rule for only one of those IPs by using daddr on an input filter. For example:

# nft insert rule inet filter output ip daddr 192.168.0.1 accept

If you instead want to add these IPs to a named set, you can create a set via the following where example_set is the name of the set.

# nft add set inet filter example_set { type ipv4_addr \; }

Then add IPs to this set via:

# nft add element inet filter example_set { 192.168.0.1, 192.168.0.2, 192.168.0.3 }

And from there, you can now reference the named set as if it was an individual ip address like this:

# nft add rule inet filter input ip saddr @example_set accept