On Wed, 14 Oct 2020, Pablo Neira Ayuso wrote: > On Wed, Oct 14, 2020 at 04:16:40AM +0000, Ramsay, Lincoln wrote: > > Hi, > > > > I've just confirmed that I can't make a rule that matches ct status != dnat. > > ct status == dnat and ct state != dnat checks for _exact_ matching. > > Then: > > ct status dnat > > based on the datatype, provides a shortcut for > > ct status and dnat == dnat Sorry, but it looks like really strange. "ct status nat" would be more natural to me. > For inverted matching, please use: > > ct status and dnat != dnat Best regards, Jozsef - E-mail : kadlec@xxxxxxxxxxxxxxxxx, kadlecsik.jozsef@xxxxxxxxx PGP key : https://wigner.hu/~kadlec/pgp_public_key.txt Address : Wigner Research Centre for Physics H-1525 Budapest 114, POB. 49, Hungary
