path: root/extensions/libebt_vlan.txlate
diff options
authorFlorian Westphal <>2018-05-08 10:15:11 +0200
committerFlorian Westphal <>2018-05-10 02:31:05 +0200
commit6454d7dc89f83920cd08606fdff43358c7e64a53 (patch)
tree33294b8d8675aaa706fb12842af294408360bbdf /extensions/libebt_vlan.txlate
parent07f4ca96816886635acfb9478b2d04929938eb78 (diff)
ebtables-translate: suppress redundant protocols
kernel would reject ip, ip6 etc. without -p ip, -p ip6. So add it. On reverse, search the match list to decide if -p has to be translated or not. Also, icmp and icmpv6 also imply l3 protocol, so no need to translate that either. Signed-off-by: Florian Westphal <>
Diffstat (limited to 'extensions/libebt_vlan.txlate')
1 files changed, 4 insertions, 4 deletions
diff --git a/extensions/libebt_vlan.txlate b/extensions/libebt_vlan.txlate
index fe1ec141..2ab62d53 100644
--- a/extensions/libebt_vlan.txlate
+++ b/extensions/libebt_vlan.txlate
@@ -1,11 +1,11 @@
-ebtables-translate -A INPUT --vlan-id 42
+ebtables-translate -A INPUT -p 802_1Q --vlan-id 42
nft add rule bridge filter INPUT vlan id 42 counter
-ebtables-translate -A INPUT --vlan-prio ! 1
+ebtables-translate -A INPUT -p 802_1Q --vlan-prio ! 1
nft add rule bridge filter INPUT vlan pcp != 1 counter
-ebtables-translate -A INPUT --vlan-encap ip
+ebtables-translate -A INPUT -p 802_1Q --vlan-encap ip
nft add rule bridge filter INPUT vlan type 0x0800 counter
-ebtables-translate -A INPUT --vlan-encap ipv6 ! --vlan-id 1
+ebtables-translate -A INPUT -p 802_1Q --vlan-encap ipv6 ! --vlan-id 1
nft add rule bridge filter INPUT vlan id != 1 vlan type 0x86dd counter