On Wed, Mar 16, 2016 at 11:00:22PM +0100, Laura Garcia Liebana wrote: > Add translation for icmp to nftables. Not supported icmp codes in nftables > are: network-unreachable, host-unreachable, protocol-unreachable, > port-unreachable, fragmentation-needed, source-route-failed, > network-unknown, host-unknown, network-prohibited, host-prohibited, > TOS-network-unreachable, TOS-host-unreachable, communication-prohibited, > host-precedence-violation, precedence-cutoff, network-redirect, > host-redirect, TOS-network-redirect, TOS-host-redirect, > ttl-zero-during-transit, ttl-zero-during-reassembly, ip-header-bad and required-option-missing. > > Examples: > > $ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type echo-reply -j ACCEPT > nft add rule ip filter INPUT icmp type echo-reply counter accept > > $ sudo iptables-translate -t filter -A INPUT -m icmp --icmp-type 3 -j ACCEPT > nft add rule ip filter INPUT icmp type destination-unreachable counter accept > > $ sudo iptables-translate -t filter -A INPUT -m icmp ! --icmp-type 3 -j ACCEPT > nft add rule ip filter INPUT icmp type != destination-unreachable counter accept Applied, thanks Laura. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
