blob: f5157b3b278a0f2bf22ced80056939cd76f9049f (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
|
#!/usr/sbin/nft -f
# This example file shows how to use sets and maps in the nftables framework.
# This script is meant to be loaded with `nft -f <file>`
# For up-to-date information please visit https://wiki.nftables.org
# symbolic anonymous set definition built from symbolic singleton definitions
define int_if1 = eth0
define int_if2 = eth1
define int_ifs = { $int_if1, $int_if2 }
define ext_if1 = eth2
define ext_if2 = eth3
define ext_ifs = { $ext_if1, $ext_if2 }
# recursive symbolic anonymous set definition
define local_ifs = { $int_ifs, $ext_ifs }
# symbolic anonymous set definition
define tcp_ports = { ssh, domain, https, 123-125 }
delete table filter
table filter {
# named set of type iface_index
set local_ifs {
type iface_index
}
# named map of type iface_index : ipv4_addr
map nat_map {
type iface_index : ipv4_addr
}
map jump_map {
type iface_index : verdict
}
chain input_1 { counter; }
chain input_2 { counter; }
chain input {
type filter hook input priority 0
# symbolic anonymous sets
meta iif $local_ifs tcp dport $tcp_ports counter
# literal anonymous set
meta iif { eth0, eth1 } counter
meta iif @local_ifs counter
meta iif vmap @jump_map
#meta iif vmap { eth0 : jump input1, eth1 : jump input2 }
}
}
|
