Blocking an IP range with nftables is straightforward, but the exact commands may need small tweaks depending on how your firewall is already structured. The example below creates a basic inet table, adds an input chain, defines a blocklist set, adds two IPv4 ranges and drops matching traffic.
sudo nft add table inet filter
sudo nft add chain inet filter input { type filter hook input priority 0\; }
sudo nft add set inet filter sshd_blocklist { type ipv4_addr\; flags interval\; }
sudo nft add element inet filter sshd_blocklist { 130.12.181.0/24, 77.83.39.0/24 }
sudo nft add rule inet filter input ip saddr @sshd_blocklist dropThe important part is the set definition:
sudo nft add set inet filter sshd_blocklist { type ipv4_addr\; flags interval\; }The flags interval option allows the set to contain CIDR ranges such as /24, instead of only individual IP addresses. Without it, ranges like 130.12.181.0/24 may not be accepted.
Once the set exists, IP ranges can be added like this:
sudo nft add element inet filter sshd_blocklist { 130.12.181.0/24 }Multiple ranges can be added at once:
sudo nft add element inet filter sshd_blocklist { 130.12.181.0/24, 77.83.39.0/24 }Finally, the rule below drops packets where the source IP address matches anything in the blocklist:
sudo nft add rule inet filter input ip saddr @sshd_blocklist dropTo check the current ruleset
sudo nft list rulesetTo remove a range from the set
sudo nft delete element inet filter sshd_blocklist { 130.12.181.0/24 }Rules added with nft add are usually runtime changes. They may disappear after a reboot unless your distribution saves and restores the ruleset. On many systems, you can save the active ruleset with:
sudo nft list ruleset | sudo tee /etc/nftables.conf