On Fri, Oct 28, 2016 at 05:56:32AM +0000, Anders K. Pedersen | Cohaesio wrote:
> From: Anders K. Pedersen <akp@xxxxxxxxxxxx>
>
> Introduce rt expression for routing related data with support for nexthop
> (i.e. the directly connected IP address that an outgoing packet is sent
> to), which can be used either for matching or accounting, eg.
>
> # nft add rule filter postrouting \
> ip daddr 192.168.1.0/24 rt nexthop != 192.168.0.1 drop
>
> This will drop any traffic to 192.168.1.0/24 that is not routed via
> 192.168.0.1.
>
> # nft add rule filter postrouting \
> flow table acct { rt nexthop timeout 600s counter }
> # nft add rule ip6 filter postrouting \
> flow table acct { rt nexthop timeout 600s counter }
>
> These rules count outgoing traffic per nexthop. Note that the timeout
> releases an entry if no traffic is seen for this nexthop within 10 minutes.
>
> # nft add rule inet filter postrouting \
> ether type ip \
> flow table acct { rt nexthop timeout 600s counter }
> # nft add rule inet filter postrouting \
> ether type ip6 \
> flow table acct { rt nexthop timeout 600s counter }
>
> Same as above, but via the inet family, where the ether type must be
> specified explicitly.
>
> "rt classid" is also implemented identical to "meta rtclassid", since it
> is more logical to have this match in the routing expression going forward.
Applied, thanks.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
