On Wed, Jun 15, 2016 at 02:21:27PM +0200, Pablo Neira Ayuso wrote:
> On Tue, Jun 14, 2016 at 08:02:45PM +0200, Laura Garcia Liebana wrote:
> > Add translation of conntrack to nftables.
> >
> > Examples:
> >
> > $ sudo iptables-translate -t filter -A INPUT -m conntrack --ctstate NEW,RELATED -j ACCEPT
> > nft add rule ip filter INPUT ct state { new,related } counter accept
>
> No need to use a set here, instead:
>
> nft add rule ip filter INPUT ct state new,related counter accept
>
> > $ sudo ip6tables-translate -t filter -A INPUT -m conntrack ! --ctstate NEW,RELATED -j ACCEPT
> > nft add rule ip6 filter INPUT ct state != { new,related } counter accept
>
> Same thing here.
>
> Thanks.
Ok, this will simplify the code.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
