Hi Patrick,
This extension of addrtype match lets the address type checking be
limited to the incoming or outgoing interface of the packets depending
on the current hook.
In the FORWARD chain only one check is allowed but the user can choose
which one would like to specifiy.
Because of this extension the match has a new revision. Rev 0 can be
used by older tools and rev 1 is for the modified iptables match.
The iptables patch is for revision 1 only.
Both the kernel module and the iptables module moved to xtables,
but the kernel module uses ipt_addrtype_info in revision 0.
Usage:
iptables -A INPUT -m addrtype ... --limit-iface-in -j ACCEPT
iptables -A OUTPUT -m addrtype ... --limit-iface-out -j ACCEPT
# 2 rules in the FORWARD chain
iptables -A FORWARD -m addrtype ... --limit-iface-in -j ACCEPT
iptables -A FORWARD -m addrtype ... --limit-iface-out -j ACCEPT
Patches:
[kernel 1/2] Find address type on a specific or on any interface
[kernel 2/2] Addrtype match: limit addrtype check to an interface.
Moved to xtables
[iptables] Adress type match: limited to incoming or outgoing interface.
Moved to xtables
Regards,
Attila
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
