Remove a filtering chain

If you don’t need a chain anymore, use bfcli chain flush to detach it from its hook and unload it.

Find the chain

You need the name of the chain. If you don’t remember it, print the ruleset:

$ sudo bfcli ruleset get
chain block_sources BF_HOOK_TC_INGRESS{ifindex=2} ACCEPT
    counters policy 0 packets 0 bytes; error 0 packets 0 bytes
    set blocklist (ip4.saddr) in {
        192.0.2.1
        192.0.2.2
    }
    rule
        (ip4.saddr) in blocklist
        counters 0 packets 0 bytes
        DROP
chain block_ping BF_HOOK_NF_LOCAL_OUT{priorities=101-102} ACCEPT
    counters policy 0 packets 0 bytes; error 0 packets 0 bytes
    rule
        ip4.daddr eq 192.0.2.1
        ip4.proto eq icmp
        icmp.type eq echo-request
        counters 0 packets 0 bytes
        DROP

You can also print a single chain to be sure it’s the one you want to remove. Let’s use the chain created in Block traffic from selected addresses as an example:

$ sudo bfcli chain get --name block_sources
chain block_sources BF_HOOK_TC_INGRESS{ifindex=2} ACCEPT
    counters policy 0 packets 0 bytes; error 0 packets 0 bytes
    set blocklist (ip4.saddr) in {
        192.0.2.1
        192.0.2.2
    }
    rule
        (ip4.saddr) in blocklist
        counters 0 packets 0 bytes
        DROP

Remove it

$ sudo bfcli chain flush --name block_sources
$ sudo bfcli ruleset get
chain block_ping BF_HOOK_NF_LOCAL_OUT{priorities=101-102} ACCEPT
    counters policy 0 packets 0 bytes; error 0 packets 0 bytes
    rule
        ip4.daddr eq 192.0.2.1
        ip4.proto eq icmp
        icmp.type eq echo-request
        counters 0 packets 0 bytes
        DROP

block_sources is gone, and so are its rules. The other chains are left untouched. If you try to print it with chain get, bfcli will tell you the chain doesn’t exist.

If you want to remove all your chains at once, use sudo bfcli ruleset flush: once this command completes, bpfilter doesn’t contain any filtering rules. It only applies to the chains pinned in the BPF filesystem used by bfcli, see --bpffs-path in bfcli commands and global options if you use more than one.