Output for command nft --debug all -f ruleset
https://gist.github.com/MrSorcus/2c8c65461e3c65fb70364f3a70d95439
On 2017-07-14 01:06, sorcus@xxxxxxxxxxx wrote:
Nftables rules for server -
https://gist.github.com/MrSorcus/17827298ad81970cc272b9e7f779923f
Nftables rules for client -
https://gist.github.com/MrSorcus/ad05f19759e02f92aac5d9c246f56cf6
I used information from here -
https://wiki.nftables.org/wiki-nftables/index.php/Performing_Network_Address_Translation_(NAT)
1. flush conntrack entries after changing of rules in the nat table.
"conntrack -D" - show me "0 flow entries have been deleted.". But
"/proc/net/nf_conntrack" has 3 entries...
2. add counters to nftables nat rule to check that rule really hit the
packets.
chain postrouting {
type nat hook postrouting priority 0; policy drop;
oif "enp0s3" nftrace set 1 counter packets 3 bytes 312 snat to
2a01:4f8:xx:xx::10
nftrace set 1 counter packets 0 bytes 0 accept comment "IPv6 < Nat <
Postrouting"
}
With git version of nftables, libmnl & libnftnl and kernels 4.9, 4.11
& 4.12 doesn't work...
With archlinux server doesn't work too...
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
