diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2021-06-02 19:57:37 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2021-06-07 21:35:27 +0200 |
| commit | bb01e33d3828d08cd77cc3c9664b2a995ee150cc (patch) | |
| tree | d51cd9287d7d570a48e8544aa336b1e5ba2182ab /extensions/libxt_connlimit.txlate | |
| parent | 62828a6aff231e9f7f40c0321f7740f53070c2fb (diff) | |
extensions: libxt_connlimit: add translation
This patch adds a translation for connlimit matches which requires
the definition of a set and the family context (either IPv4 or IPv6)
which is required to display the netmask accordingly.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'extensions/libxt_connlimit.txlate')
| -rw-r--r-- | extensions/libxt_connlimit.txlate | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/extensions/libxt_connlimit.txlate b/extensions/libxt_connlimit.txlate new file mode 100644 index 00000000..758868c4 --- /dev/null +++ b/extensions/libxt_connlimit.txlate @@ -0,0 +1,15 @@ +iptables-translate -A INPUT -m connlimit --connlimit-above 2 +nft add set ip filter connlimit0 { type ipv4_addr; flags dynamic; } +nft add rule ip filter INPUT add @connlimit0 { ip saddr ct count over 2 } counter + +iptables-translate -A INPUT -m connlimit --connlimit-upto 2 +nft add set ip filter connlimit0 { type ipv4_addr; flags dynamic; } +nft add rule ip filter INPUT add @connlimit0 { ip saddr ct count 2 } counter + +iptables-translate -A INPUT -m connlimit --connlimit-upto 2 --connlimit-mask 24 +nft add set ip filter connlimit0 { type ipv4_addr; flags dynamic; } +nft add rule ip filter INPUT add @connlimit0 { ip saddr and 255.255.255.0 ct count 2 } counter + +iptables-translate -A INPUT -m connlimit --connlimit-upto 2 --connlimit-daddr +nft add set ip filter connlimit0 { type ipv4_addr; flags dynamic; } +nft add rule ip filter INPUT add @connlimit0 { ip daddr ct count 2 } counter |