Chains

Chains are defined such as:

chain $NAME $HOOK[{$OPTIONS}] $POLICY

With:

• $NAME: user-defined name for the chain.

• $HOOK: hook in the kernel to attach the chain to, see Hooks.

• $OPTIONS: optional hook options, between braces. See Hooks. Omit the braces if you don’t define any option.

• $POLICY: action taken once the packet went through all the rules, if none of them stopped its processing:

  • ACCEPT: forward the packet to the kernel.

  • DROP: discard the packet.

  • NEXT: pass the packet to the next BPF program. For TC hooks, this maps to TCX_NEXT, deferring the decision to the next program in the TCX link. For other hooks, NEXT behaves identically to ACCEPT since these hooks do not distinguish between “accept” and “pass to next program.”

  Note: CONTINUE and REDIRECT are not valid chain policies.

A chain contains its named sets, followed by its rules. See Ruleset syntax, Rules, actions, and verdicts, and Sets.

Example

chain block_destination BF_HOOK_NF_LOCAL_OUT{priorities=101-102} ACCEPT
    rule
        ip4.daddr eq 192.0.2.1
        counter
        DROP

See Loading, attaching, and updating chains to understand the difference between a loaded chain and an attached chain.