Hi Jozsef, On Wed, Oct 14, 2020 at 12:25:40PM +0200, Jozsef Kadlecsik wrote: > On Wed, 14 Oct 2020, Pablo Neira Ayuso wrote: > > > On Wed, Oct 14, 2020 at 04:16:40AM +0000, Ramsay, Lincoln wrote: > > > Hi, > > > > > > I've just confirmed that I can't make a rule that matches ct status != dnat. > > > > ct status == dnat and ct state != dnat checks for _exact_ matching. > > > > Then: > > > > ct status dnat > > > > based on the datatype, provides a shortcut for > > > > ct status and dnat == dnat > > Sorry, but it looks like really strange. "ct status nat" would be more > natural to me. This is based on the ct status bits, so dnat is matching for destination NAT updates (ie. IPS_DST_NAT). Then, snat is matching for IPS_SRC_NAT. It should be possible to add ct status nat but such nat would be (IPS_SRC_NAT | IPS_DST_NAT)
