From 0d7fdb10b10c7a6c276cdb467d824db9b032140b Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Tue, 26 Jul 2016 22:04:53 +0200 Subject: doc: payload and conntrack statement Signed-off-by: Florian Westphal Acked-by: Pablo Neira Ayuso --- doc/nft.xml | 82 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 81 insertions(+), 1 deletion(-) diff --git a/doc/nft.xml b/doc/nft.xml index 62976747..3b215f8c 100644 --- a/doc/nft.xml +++ b/doc/nft.xml @@ -2037,7 +2037,7 @@ filter output oif eth0 label - Connection tracking label + Connection tracking label bit or symbolic name defined in connlabel.conf in the nftables include path ct_label @@ -2206,6 +2206,29 @@ filter input iif eth0 drop + + Payload statement + + The payload statement alters packet content. + It can be used for example to set ip DSCP (differv) header field or ipv6 flow labels. + + + + route some packets instead of bridging + +# redirect tcp:http from 192.160.0.0/16 to local machine for routing instead of bridging +# assumes 00:11:22:33:44:55 is local MAC address. +bridge input meta iif eth0 ip saddr 192.168.0.0/16 tcp dport 80 meta pkttype set unicast ether daddr set 00:11:22:33:44:55 + + + + Set IPv4 DSCP header field + +ip forward ip dscp set 42 + + + + Log statement @@ -2389,6 +2412,63 @@ filter input iif eth0 drop + + Conntrack statement + + The conntrack statement can be used to set the conntrack mark and conntrack labels. + + + + ct + + mark + label + + set + value + + + + The ct statement sets meta data associated with a connection. + + + + Meta statement types + + + + + + + Keyword + Description + Value + + + + + mark + Connection tracking mark + mark + + + label + Connection tracking label + label + + + +
+ + + + save packet nfmark in conntrack + +ct set mark meta mark + + + + Meta statement -- cgit v1.2.3