# meta nfproto ipv4 [ { "match": { "left": { "meta": { "key": "nfproto" } }, "op": "==", "right": "ipv4" } } ] # meta nfproto ipv6 [ { "match": { "left": { "meta": { "key": "nfproto" } }, "op": "==", "right": "ipv6" } } ] # meta nfproto {ipv4, ipv6} [ { "match": { "left": { "meta": { "key": "nfproto" } }, "op": "==", "right": { "set": [ "ipv4", "ipv6" ] } } } ] # meta nfproto != {ipv4, ipv6} [ { "match": { "left": { "meta": { "key": "nfproto" } }, "op": "!=", "right": { "set": [ "ipv4", "ipv6" ] } } } ] # meta nfproto ipv6 tcp dport 22 [ { "match": { "left": { "meta": { "key": "nfproto" } }, "op": "==", "right": "ipv6" } }, { "match": { "left": { "payload": { "field": "dport", "protocol": "tcp" } }, "op": "==", "right": 22 } } ] # meta nfproto ipv4 tcp dport 22 [ { "match": { "left": { "meta": { "key": "nfproto" } }, "op": "==", "right": "ipv4" } }, { "match": { "left": { "payload": { "field": "dport", "protocol": "tcp" } }, "op": "==", "right": 22 } } ] # meta nfproto ipv4 ip saddr 1.2.3.4 [ { "match": { "left": { "meta": { "key": "nfproto" } }, "op": "==", "right": "ipv4" } }, { "match": { "left": { "payload": { "field": "saddr", "protocol": "ip" } }, "op": "==", "right": "1.2.3.4" } } ] # meta nfproto ipv6 meta l4proto tcp [ { "match": { "left": { "meta": { "key": "nfproto" } }, "op": "==", "right": "ipv6" } }, { "match": { "left": { "meta": { "key": "l4proto" } }, "op": "==", "right": "tcp" } } ] # meta nfproto ipv4 counter ip saddr 1.2.3.4 [ { "match": { "left": { "meta": { "key": "nfproto" } }, "op": "==", "right": "ipv4" } }, { "counter": null }, { "match": { "left": { "payload": { "field": "saddr", "protocol": "ip" } }, "op": "==", "right": "1.2.3.4" } } ] # meta ipsec exists [ { "match": { "left": { "meta": { "key": "ipsec" } }, "op": "==", "right": true } } ] # meta secpath missing [ { "match": { "left": { "meta": { "key": "secpath" } }, "op": "==", "right": false } } ] # meta mark set ct mark >> 8 [ { "mangle": { "key": { "meta": { "key": "mark" } }, "value": { ">>": [ { "ct": { "key": "mark" } }, 8 ] } } } ] # meta protocol ip udp dport 67 [ { "match": { "left": { "meta": { "key": "protocol" } }, "op": "==", "right": "ip" } }, { "match": { "left": { "payload": { "field": "dport", "protocol": "udp" } }, "op": "==", "right": 67 } } ] # meta protocol ip6 udp dport 67 [ { "match": { "left": { "meta": { "key": "protocol" } }, "op": "==", "right": "ip6" } }, { "match": { "left": { "payload": { "field": "dport", "protocol": "udp" } }, "op": "==", "right": 67 } } ] # meta mark . tcp dport { 0x0000000a-0x00000014 . 80-90, 0x00100000-0x00100123 . 100-120 } [ { "match": { "left": { "concat": [ { "meta": { "key": "mark" } }, { "payload": { "field": "dport", "protocol": "tcp" } } ] }, "op": "==", "right": { "set": [ { "concat": [ { "range": [ 10, 20 ] }, { "range": [ 80, 90 ] } ] }, { "concat": [ { "range": [ 1048576, 1048867 ] }, { "range": [ 100, 120 ] } ] } ] } } } ] # ip saddr . meta mark { 1.2.3.4 . 0x00000100 , 1.2.3.6-1.2.3.8 . 0x00000200-0x00000300 } [ { "match": { "left": { "concat": [ { "payload": { "field": "saddr", "protocol": "ip" } }, { "meta": { "key": "mark" } } ] }, "op": "==", "right": { "set": [ { "concat": [ "1.2.3.4", 256 ] }, { "concat": [ { "range": [ "1.2.3.6", "1.2.3.8" ] }, { "range": [ 512, 768 ] } ] } ] } } } ] # ip saddr . meta mark { 1.2.3.4 . 0x00000100 , 5.6.7.8 . 0x00000200 } [ { "match": { "left": { "concat": [ { "payload": { "field": "saddr", "protocol": "ip" } }, { "meta": { "key": "mark" } } ] }, "op": "==", "right": { "set": [ { "concat": [ "1.2.3.4", 256 ] }, { "concat": [ "5.6.7.8", 512 ] } ] } } } ] # meta mark set ip dscp [ { "mangle": { "key": { "meta": { "key": "mark" } }, "value": { "payload": { "field": "dscp", "protocol": "ip" } } } } ] # meta mark set ip dscp | 0x40 [ { "mangle": { "key": { "meta": { "key": "mark" } }, "value": { "|": [ { "payload": { "field": "dscp", "protocol": "ip" } }, 64 ] } } } ] # meta mark set ip6 dscp [ { "mangle": { "key": { "meta": { "key": "mark" } }, "value": { "payload": { "field": "dscp", "protocol": "ip6" } } } } ] # meta mark set ip6 dscp | 0x40 [ { "mangle": { "key": { "meta": { "key": "mark" } }, "value": { "|": [ { "payload": { "field": "dscp", "protocol": "ip6" } }, 64 ] } } } ]