blob: 3b1d5718057b15b389552bbb2bb50d0c642814b8 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
|
iptables-translate -A FORWARD -p esp -j ACCEPT
nft 'add rule ip filter FORWARD ip protocol esp counter accept'
iptables-translate -A INPUT --in-interface wan --protocol esp -j ACCEPT
nft 'add rule ip filter INPUT iifname "wan" ip protocol esp counter accept'
iptables-translate -A INPUT -p 50 -m esp --espspi 500 -j DROP
nft 'add rule ip filter INPUT esp spi 500 counter drop'
iptables-translate -A INPUT -p 50 -m esp --espspi 500:600 -j DROP
nft 'add rule ip filter INPUT esp spi 500-600 counter drop'
iptables-translate -A INPUT -p 50 -m esp --espspi 0:4294967295 -j DROP
nft 'add rule ip filter INPUT counter drop'
iptables-translate -A INPUT -p 50 -m esp ! --espspi 0:4294967295 -j DROP
nft 'add rule ip filter INPUT counter drop'
ip6tables-translate -A INPUT -p 50 -m esp --espspi 0:4294967295 -j DROP
nft 'add rule ip6 filter INPUT counter drop'
ip6tables-translate -A INPUT -p 50 -m esp ! --espspi 0:4294967295 -j DROP
nft 'add rule ip6 filter INPUT counter drop'
|
