nftables中带constant标志的IP集合无法修改的问题求助

2025年计划从iptables/ipset迁移到nftables，搭建新服务器时开始尝试，遇到了集合修改的问题。

服务器环境 #

# uname -a
Linux starnet 6.12.6-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.6-1 (2024-12-21) x86_64 GNU/Linux

# nft -V
nftables v1.1.1 (Commodore Bullmoose #2)
  cli:          editline
  json:         yes
  minigmp:      no
  libxtables:   yes

操作步骤与问题 #

编写bash脚本创建IP集合：

#!/bin/bash

NFT=/usr/sbin/nft
$NFT add set inet filter ALLOWIPS { type ipv4_addr \; flags constant, interval \; }
$NFT flush set inet filter ALLOWIPS

$NFT add element inet filter ALLOWIPS { 172.17.0.0/24 }
$NFT add element inet filter ALLOWIPS { 192.168.0.0/24 }

$NFT add element inet filter ALLOWIPS { 192.168.1.58 }
$NFT add element inet filter ALLOWIPS { 192.168.1.89 }
$NFT add element inet filter ALLOWIPS { 192.168.1.125 }
$NFT add element inet filter ALLOWIPS { 192.168.1.179 }
$NFT add element inet filter ALLOWIPS { 192.168.1.212 }

执行后查看集合，显示正常：

# nft list set inet filter ALLOWIPS
table inet filter {
        set ALLOWIPS {
                type ipv4_addr
                flags constant,interval
                elements = { 172.17.0.0/24, 192.168.0.0/24,
                             192.168.1.58, 192.168.1.89,
                             192.168.1.125, 192.168.1.179,
                             192.168.1.212 }
        }
}

此时可以正常删除集合元素：

# nft delete element inet filter ALLOWIPS { 192.168.1.58 }

# nft list set inet filter ALLOWIPS
table inet filter {
        set ALLOWIPS {
                type ipv4_addr
                flags constant,interval
                elements = { 172.17.0.0/24, 192.168.0.0/24,
                             192.168.1.89, 192.168.1.125,
                             192.168.1.179, 192.168.1.212 }
        }
}

但添加引用该集合的规则后：

# nft add rule inet filter input iifname int1 ip daddr 8.8.8.8  ip saddr @ALLOWIPS accept

无法再修改集合，执行添加元素或清空集合命令时均报错：

# nft add element inet filter ALLOWIPS { 192.168.1.58 }
Error: Could not process rule: Device or resource busy
add element inet filter ALLOWIPS { 192.168.1.58 }
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

# nft flush set inet filter ALLOWIPS
Error: Could not process rule: Device or resource busy
flush set inet filter ALLOWIPS
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

根据nftables官方文档说明：Named sets can be updated anytime.，但实际遇到上述问题，求解决办法。

内容的提问来源于stack exchange，提问作者Vaidas M