diff options
| author | Florian Westphal <fw@strlen.de> | 2018-04-19 11:19:52 +0200 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2018-04-19 13:07:41 +0200 |
| commit | 5c8ce9c6aede0277b4f88482a8c87fb1662d4b85 (patch) | |
| tree | 8617f468722abd5e193732781bbf990007b341d0 /extensions/libebt_ip6.txlate | |
| parent | 8a85a148d0a4765cf15b05e2b3088a1a0562bf50 (diff) | |
ebtables-compat: add 'ip6' match extension
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'extensions/libebt_ip6.txlate')
| -rw-r--r-- | extensions/libebt_ip6.txlate | 29 |
1 files changed, 29 insertions, 0 deletions
diff --git a/extensions/libebt_ip6.txlate b/extensions/libebt_ip6.txlate new file mode 100644 index 00000000..0f2efdf8 --- /dev/null +++ b/extensions/libebt_ip6.txlate @@ -0,0 +1,29 @@ +ebtables-translate -A FORWARD --ip6-src ! dead::beef/64 -j ACCEPT +nft add rule bridge filter FORWARD ip6 saddr != dead::/64 counter accept + +ebtables-translate -A FORWARD ! --ip6-dst dead:beef::/64 -j ACCEPT +nft add rule bridge filter FORWARD ip6 daddr != dead:beef::/64 counter accept + +ebtables-translate -I FORWARD --ip6-dst f00:ba:: +nft insert rule bridge filter FORWARD ip6 daddr f00:ba:: counter + +ebtables-translate -I OUTPUT -o eth0 --ip6-tclass 0xff +nft insert rule bridge filter OUTPUT oifname "eth0" ip6 dscp 0x3f counter + +ebtables-translate -A FORWARD --ip6-proto tcp --ip6-dport 22 +nft add rule bridge filter FORWARD ether type ip6 tcp dport 22 counter + +ebtables-translate -A FORWARD --ip6-proto udp --ip6-sport 1024:65535 +nft add rule bridge filter FORWARD ether type ip6 udp sport 1024-65535 counter + +ebtables-translate -A FORWARD --ip6-proto 253 +nft add rule bridge filter FORWARD ether type ip6 meta l4proto 253 counter + +ebtables-translate -A FORWARD --ip6-icmp-type "echo-request" +nft add rule bridge filter FORWARD icmpv6 type 128 counter + +ebtables-translate -A FORWARD --ip6-icmp-type 1/1 +nft add rule bridge filter FORWARD icmpv6 type 1 icmpv6 code 1 counter + +ebtables-translate -A FORWARD --ip6-icmp-type ! 1:10 +nft add rule bridge filter FORWARD icmpv6 type != 1-10 counter |