On 2019/1/18 下午10:18, Pablo Neira Ayuso wrote: > On Thu, Jan 10, 2019 at 01:16:08PM +0800, wenxu@xxxxxxxxx wrote: >> From: wenxu <wenxu@xxxxxxxxx> >> >> This patch allows us to match on the tunnel metadata that is available >> of the packet. We can use this to validate if the packet comes from/goes >> to tunnel and the corresponding tunnel ID in the iptables. > One more question, we already have support for this in nft_tunnel.c, > would it be good if we just add the missing pieces to userspace there? > I have some patches here I need to push out for this... > Yes, nftables can do this. I just want the people also can get it through iptables. Anyway It's fine for me.
