Translation for iptables raw rules that targert rtsp / Conntrack helper,

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hello all,

I've setup nf_nat_rtsp / nf_conntrack_rtsp to handle iptv flow from my internet provider. This now work ok, but to make it work correctly, I need a rule like this one in the firewall:

    iptables-nft -t raw -A PREROUTING -p tcp --dport 554 -j CT --helper rtsp

So If Issue this command, everything is working of.
The matter is that I don't know how to translate it to put in my firewall.nft file.

nft list ruleset give me something like:

# Warning: table ip raw is managed by iptables-nft, do not touch!
table ip raw {
        chain PREROUTING {
                type filter hook prerouting priority raw; policy accept;
                tcp dport 554 counter packets 0 bytes 0 xt target "CT"
        }
}

If i put something like

table ip raw {
        chain PREROUTING {
                tcp dport 554 -j "CT"
                tcp dport 554 counter xt target "CT";
        }
}


I've got an error on loading:

nft flush ruleset; nft -f /etc/nftables/main.nft
    /etc/nftables/main.nft:380:27-40: Error: unsupported xtables compat expression, use iptables-nft with this ruleset
      tcp dport 554 counter xt target "CT";

I've also try the following syntax:

table ip raw {
        chain PREROUTING {
                type filter hook prerouting priority raw; policy accept;
                tcp dport 554 counter ct helper rtsp;
        }

}

This is loading ok, but have no effect.
Can someone point me the good way to target the rtsp conntrack from nftables ?

Thanks,

       Laurent.





[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux