diff options
Diffstat (limited to 'extensions/libxt_esp.txlate')
| -rw-r--r-- | extensions/libxt_esp.txlate | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/extensions/libxt_esp.txlate b/extensions/libxt_esp.txlate index f6aba52f..5e8fb241 100644 --- a/extensions/libxt_esp.txlate +++ b/extensions/libxt_esp.txlate @@ -9,3 +9,15 @@ nft 'add rule ip filter INPUT esp spi 500 counter drop' iptables-translate -A INPUT -p 50 -m esp --espspi 500:600 -j DROP nft 'add rule ip filter INPUT esp spi 500-600 counter drop' + +iptables-translate -A INPUT -p 50 -m esp --espspi 0:4294967295 -j DROP +nft 'add rule ip filter INPUT meta l4proto esp counter drop' + +iptables-translate -A INPUT -p 50 -m esp ! --espspi 0:4294967295 -j DROP +nft 'add rule ip filter INPUT esp spi != 0-4294967295 counter drop' + +ip6tables-translate -A INPUT -p 50 -m esp --espspi 0:4294967295 -j DROP +nft 'add rule ip6 filter INPUT exthdr esp exists counter drop' + +ip6tables-translate -A INPUT -p 50 -m esp ! --espspi 0:4294967295 -j DROP +nft 'add rule ip6 filter INPUT esp spi != 0-4294967295 counter drop' |