diff options
| author | Florian Westphal <fw@strlen.de> | 2018-05-08 10:15:11 +0200 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2018-05-10 02:31:05 +0200 |
| commit | 6454d7dc89f83920cd08606fdff43358c7e64a53 (patch) | |
| tree | 33294b8d8675aaa706fb12842af294408360bbdf /extensions/libebt_ip.txlate | |
| parent | 07f4ca96816886635acfb9478b2d04929938eb78 (diff) | |
ebtables-translate: suppress redundant protocols
kernel would reject ip, ip6 etc. without -p ip, -p ip6.
So add it. On reverse, search the match list to decide if -p
has to be translated or not.
Also, icmp and icmpv6 also imply l3 protocol, so no need to translate
that either.
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'extensions/libebt_ip.txlate')
| -rw-r--r-- | extensions/libebt_ip.txlate | 18 |
1 files changed, 9 insertions, 9 deletions
diff --git a/extensions/libebt_ip.txlate b/extensions/libebt_ip.txlate index cbe05f4f..b5882c34 100644 --- a/extensions/libebt_ip.txlate +++ b/extensions/libebt_ip.txlate @@ -1,26 +1,26 @@ -ebtables-translate -A FORWARD --ip-src ! 192.168.0.0/24 -j ACCEPT +ebtables-translate -A FORWARD -p ip --ip-src ! 192.168.0.0/24 -j ACCEPT nft add rule bridge filter FORWARD ip saddr != 192.168.0.0/24 counter accept -ebtables-translate -I FORWARD --ip-dst 10.0.0.1 +ebtables-translate -I FORWARD -p ip --ip-dst 10.0.0.1 nft insert rule bridge filter FORWARD ip daddr 10.0.0.1 counter -ebtables-translate -I OUTPUT 3 -o eth0 --ip-tos 0xff +ebtables-translate -I OUTPUT 3 -p ip -o eth0 --ip-tos 0xff nft insert rule bridge filter OUTPUT oifname "eth0" ip dscp 0x3f counter -ebtables-translate -A FORWARD --ip-proto tcp --ip-dport 22 +ebtables-translate -A FORWARD -p ip --ip-proto tcp --ip-dport 22 nft add rule bridge filter FORWARD tcp dport 22 counter -ebtables-translate -A FORWARD --ip-proto udp --ip-sport 1024:65535 +ebtables-translate -A FORWARD -p ip --ip-proto udp --ip-sport 1024:65535 nft add rule bridge filter FORWARD udp sport 1024-65535 counter -ebtables-translate -A FORWARD --ip-proto 253 +ebtables-translate -A FORWARD -p ip --ip-proto 253 nft add rule bridge filter FORWARD ip protocol 253 counter -ebtables-translate -A FORWARD --ip-icmp-type "echo-request" +ebtables-translate -A FORWARD -p ip --ip-protocol icmp --ip-icmp-type "echo-request" nft add rule bridge filter FORWARD icmp type 8 counter -ebtables-translate -A FORWARD --ip-icmp-type 1/1 +ebtables-translate -A FORWARD -p ip --ip-proto icmp --ip-icmp-type 1/1 nft add rule bridge filter FORWARD icmp type 1 icmp code 1 counter -ebtables-translate -A FORWARD --ip-icmp-type ! 1:10 +ebtables-translate -A FORWARD -p ip --ip-protocol icmp --ip-icmp-type ! 1:10 nft add rule bridge filter FORWARD icmp type != 1-10 counter |