On Tue, Oct 20, 2015 at 04:34:27PM +0200, giorgio.nicole@xxxxxxxx wrote: > Hi, > > that's right but my main script fw_basic.nft should be a read only file; > the dynamic behavior should result from the content of the included files > at the end of the script. > > ... > include "/var/lib/nftables/user.nft" > include "/var/lib/nftables/dnats.nft" > > In my target system I have two configuration programs/daemons: the first > generates the nft file '/var/lib/nftables/user.nft' with rules from the user, the > second generates dnat rules (actually one rule with a set of multiple targets) > on the basis of zeroconfig-found devices in the file '/var/lib/nftables/dnats.nft'; > > The main nft script then includes both the generated files actually implementing > a dynamic firewall config. > > This also works in case the user, for example, disables his part of the configuration: > in this case the file '/var/lib/nftables/user.nft' will be empty and the next call to the script > '/etc/nftable/fw_basic.nft' will actually (atomically) remove the user configs from the firewall. Make sense. Will ping you once I have push out the kernel patches to remove the existing limitation on updating objects from the same batch, so you have the chance to test it. Thanks. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
