You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
37 lines
1.7 KiB
37 lines
1.7 KiB
4 months ago
|
iptables-translate -I OUTPUT -p udp -d 8.8.8.8 -j ACCEPT
|
||
|
|
nft insert rule ip filter OUTPUT ip protocol udp ip daddr 8.8.8.8 counter accept
|
||
|
|
|
||
|
|
iptables-translate -F -t nat
|
||
|
|
nft flush table ip nat
|
||
|
|
|
||
|
|
iptables-translate -I INPUT -i iifname -s 10.0.0.0/8
|
||
|
|
nft insert rule ip filter INPUT iifname "iifname" ip saddr 10.0.0.0/8 counter
|
||
|
|
|
||
|
|
iptables-translate -A INPUT -i iif+ ! -d 10.0.0.0/8
|
||
|
|
nft add rule ip filter INPUT iifname "iif*" ip daddr != 10.0.0.0/8 counter
|
||
|
|
|
||
|
|
ebtables-translate -I INPUT -i iname --logical-in ilogname -s 0:0:0:0:0:0
|
||
|
|
nft insert rule bridge filter INPUT iifname "iname" meta ibrname "ilogname" ether saddr 00:00:00:00:00:00 counter
|
||
|
|
|
||
|
|
ebtables-translate -A FORWARD ! -i iname --logical-in ilogname -o out+ --logical-out lout+ -d 1:2:3:4:de:af
|
||
|
|
nft add rule bridge filter FORWARD iifname != "iname" meta ibrname "ilogname" oifname "out*" meta obrname "lout*" ether daddr 01:02:03:04:de:af counter
|
||
|
|
|
||
|
|
ebtables-translate -I INPUT -p ip -d 1:2:3:4:5:6/ff:ff:ff:ff:00:00
|
||
|
|
nft insert rule bridge filter INPUT ether type 0x800 ether daddr 01:02:03:04:00:00 and ff:ff:ff:ff:00:00 == 01:02:03:04:00:00 counter
|
||
|
|
|
||
|
|
# asterisk is not special in iptables and it is even a valid interface name
|
||
|
|
iptables-translate -A FORWARD -i '*' -o 'eth*foo'
|
||
|
|
nft add rule ip filter FORWARD iifname "\*" oifname "eth\*foo" counter
|
||
|
|
|
||
|
|
# escape all asterisks but translate only the first plus character
|
||
|
|
iptables-translate -A FORWARD -i 'eth*foo*+' -o 'eth++'
|
||
|
|
nft add rule ip filter FORWARD iifname "eth\*foo\**" oifname "eth+*" counter
|
||
|
|
|
||
|
|
# skip for always matching interface names
|
||
|
|
iptables-translate -A FORWARD -i '+'
|
||
|
|
nft add rule ip filter FORWARD counter
|
||
|
|
|
||
|
|
# match against invalid interface name to simulate never matching rule
|
||
|
|
iptables-translate -A FORWARD ! -i '+'
|
||
|
|
nft add rule ip filter FORWARD iifname "INVAL/D" counter
|