Correct syntax

[jedi-nz]

I have Ubuntu 20.04 with nftables version 9.3.

I added a set named geo-shh to the filter table. Here is the relevant section of /etc/nftables.conf:

# Add an inet table to allow both IPv4 and IPv6 traffic.
table inet filter {

# We can do geolocation packet filtering in this table too.
# Define empty set to store IPv4 country code specific address ranges.
set geo-inet4 {
type ipv4_addr
flags interval
# Elements for this set are defined in /etc/nftables/geo-nft/refill-sets.conf
}

# Define empty set to store IPv6 country code specific address ranges.
set geo-inet6 {
type ipv6_addr
flags interval
# Elements for this set are defined in /etc/nftables/geo-nft/refill-sets.conf
}

set geo-ssh {
type ipv4_addr
flags interval
}

I then added a define line to /etc/nftables/geo-nft/refill-sets.conf:

root@zen:~# tail -3 /etc/nftables/geo-nft/refill-sets.conf
# Add any additional 'define-ipv4' or 'define-ipv6' lines here:

define-ipv4 inet filter geo-ssh NZ

I then populated the set by running geo-nft. However when I added the rule exactly as provided to GlennToms in his question Adding Sets

tcp saddr @geo-channel4 dport 22 counter accept comment "Accept SSH on port 22 from addresses in set @geo-ssh"

it produced an error

root@zen:~# /usr/sbin/nft --check --file /etc/nftables.conf
/etc/nftables.conf:79:9-13: Error: syntax error, unexpected saddr
tcp saddr @geo-ssh dport 22 counter accept comment "Accept SSH on port 22 from addresses in set @geo-ssh"
    ^^^^^

What worked for me was

ip saddr @geo-ssh tcp dport 22 counter accept comment "Accept SSH on port 22 from addresses in set @geo-ssh"

[wirefalls]

I'm glad that you were able to get it working. I gave the wrong syntax in the other thread, I'll correct that. Thanks for updating your post.