On Tue, Jun 14, 2016 at 08:02:45PM +0200, Laura Garcia Liebana wrote:
> Add translation of conntrack to nftables.
>
> Examples:
>
> $ sudo iptables-translate -t filter -A INPUT -m conntrack --ctstate
> NEW,RELATED -j ACCEPT
> nft add rule ip filter INPUT ct state { new,related } counter accept
No need to use a set here, instead:
nft add rule ip filter INPUT ct state new,related counter accept
> $ sudo ip6tables-translate -t filter -A INPUT -m conntrack ! --ctstate
> NEW,RELATED -j ACCEPT
> nft add rule ip6 filter INPUT ct state != { new,related } counter accept
Same thing here.
Thanks.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
