---
title: "How To: Whitelist An IP Address In 'nftables'"
slug: "how-to-whitelist-an-ip-address-in-nftables"
updated: 2026-07-07T04:46:57Z
published: 2026-07-07T04:46:57Z
canonical: "docs.serversaustralia.com.au/how-to-whitelist-an-ip-address-in-nftables"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.serversaustralia.com.au/llms.txt
> Use this file to discover all available pages before exploring further.

# How To: Whitelist An IP Address In 'nftables'

Most Modern Linux distributions will use nftables as the default firewall, though they may have a more end-user friendly interface with it, such as UFW.

Here are the commands to whitelist an IP address on your Linux server, both incoming and outgoing.

**Example: How to whitelist IP address 192.168.0.1**

**Step 1:** Log into the server via SSH.

**Step 2:** Allow incoming connections from 192.168.0.1

```shell
# nft insert rule inet filter input ip saddr 192.168.0.1 accept
```

Note: We use **insert** instead of **add** for these rules to ensure it is placed a the top of the input. **add** puts them at the bottom instead and is useful for deny rules. **Step 3:** Allow outgoing connections to 192.168.0.1

```shell
# nft insert rule inet filter output ip daddr 192.168.0.1 accept
```

## Additional Options:

If you have multiple IPs assigned, you can specify an allow rule for only one of those IPs by using **daddr** on an **input** filter. For example:

```shell
# nft insert rule inet filter output ip daddr 192.168.0.1 accept
```

If you instead want to add these IPs to a named set, you can create a set via the following where **example_set** is the name of the set.

```shell
# nft add set inet filter example_set { type ipv4_addr \; }
```

Then add IPs to this set via:

```shell
# nft add element inet filter example_set { 192.168.0.1, 192.168.0.2, 192.168.0.3 }
```

And from there, you can now reference the named set as if it was an individual ip address like this:

```shell
# nft add rule inet filter input ip saddr @example_set accept
```