I use ipset for my setup to simplify certain iptables rules. I have
rules to allow trusted networks and trusted services using two different
sets. The services set is a hash:net,port set, and the network set its
a hash:net,iface set. Is it planned to have sets that can contain
multiple value entries in nftables? Also, as some of my interfaces are
dynamic, would such sets support interface names instead of indexes?
Something like { (10.10.1.0/24,"eth0"), (10.20.1.0/24,"tap0") }? Or if
not, is there a way to use the existing ipset utility with nftables?
# Allow access to all services for traffic to/from certain networks on
specific interfaces
iptables -A INPUT -m set --match-set networks src,src -j ACCEPT
iptables -A OUTPUT -m set --match-set networks dst,dst -j ACCEPT
# Allow access to specific services from certain networks
iptables -A INPUT -m set --match-set services dst,src -j ACCEPT
iptables -A OUTPUT -m set --match-set services src,dst -j ACCEPT
# Perhaps translated to nft as
nft filter input ip saddr + iifname @networks accept
nft filter output ip daddr + oifname @networks accept
nft filter input ip saddr + dport @services accept
nft filter output ip daddr + sport @services accept
I have seem that this might be possible with maps, but one feature of a
set over a map that I like seems to be I'd only have to add the matching
information to the set, while the action such as accept, drop, or jump
is not part of the set but is hard-coded in the added rule.
Brian Vanderburg II
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
