Hi Patrick, This extension of ipt_addrtype match lets the address type checking be limited to the incoming or outgoing interface of the packets depending on the current hook. In the FORWARD chain only one check is allowed but the user can choose which one would like to specifiy. Because of this extension the match has a new revision. Rev 0 can be used by older tools and rev 1 is for the modified iptables match. The iptables patch is for revision 1 only. Usage: iptables -A INPUT -m addrtype ... --limit-iface-in -j ACCEPT iptables -A OUTPUT -m addrtype ... --limit-iface-out -j ACCEPT # 2 rules in the FORWARD chain iptables -A FORWARD -m addrtype ... --limit-iface-in -j ACCEPT iptables -A FORWARD -m addrtype ... --limit-iface-out -j ACCEPT Regards, Attila - To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
