diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2021-05-28 00:33:41 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2021-05-28 14:38:35 +0200 |
| commit | c36d772a909950dc53d11c1e78ad4772715943f1 (patch) | |
| tree | 8f8fd38b61d6c60a2295850c5174ea6450a20dd7 | |
| parent | cd5135377ac42896a99226d182c49bf220f44ab5 (diff) | |
doc: manual: Document userspace helper configuration at daemon startup
Describe how to configure conntrackd using the new simple setup approach.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| -rw-r--r-- | doc/manual/conntrack-tools.tmpl | 42 |
1 files changed, 21 insertions, 21 deletions
diff --git a/doc/manual/conntrack-tools.tmpl b/doc/manual/conntrack-tools.tmpl index 64ac5dd..822dd49 100644 --- a/doc/manual/conntrack-tools.tmpl +++ b/doc/manual/conntrack-tools.tmpl @@ -905,32 +905,13 @@ maintainance.</para></listitem> <para>The following steps describe how to enable the RPC portmapper helper for NFSv3 (this is similar for other helpers):</para> <orderedlist> -<listitem><para>Register user-space helper: - -<programlisting> -nfct add helper rpc inet udp -nfct add helper rpc inet tcp -</programlisting> - -This registers the portmapper helper for both UDP and TCP (NFSv3 traffic goes both over TCP and UDP). -</para></listitem> - -<listitem><para>Add iptables rule using the CT target: - -<programlisting> -# iptables -I OUTPUT -t raw -p udp --dport 111 -j CT --helper rpc -# iptables -I OUTPUT -t raw -p tcp --dport 111 -j CT --helper rpc -</programlisting> - -With this, packets matching port TCP/UDP/111 are passed to user-space for -inspection. If there is no instance of conntrackd configured to support -user-space helpers, no inspection happens and packets are not sent to -user-space.</para></listitem> <listitem><para>Add configuration to conntrackd.conf: <programlisting> Helper { + Setup yes + Type rpc inet udp { QueueNum 1 QueueLen 10240 @@ -962,6 +943,25 @@ for inspection to user-space</para> </listitem> +<listitem><para>Run conntrackd: +<programlisting> +# conntrackd -d -C /path/to/conntrackd.conf +</programlisting> +</para> +</listitem> + +<listitem><para>Add iptables rule using the CT target: + +<programlisting> +# iptables -I OUTPUT -t raw -p udp --dport 111 -j CT --helper rpc +# iptables -I OUTPUT -t raw -p tcp --dport 111 -j CT --helper rpc +</programlisting> + +With this, packets matching port TCP/UDP/111 are passed to user-space for +inspection. If there is no instance of conntrackd configured to support +user-space helpers, no inspection happens and packets are not sent to +user-space.</para></listitem> + </orderedlist> <para>Now you can test this (assuming you have some working NFSv3 setup) with: |