Concatenations - Revision history

Fmyhr: Use "dnat to".

2021-04-20T01:48:36Z

Use "dnat to".

← Older revision		Revision as of 01:48, 20 April 2021
Line 69:		Line 69:

	<source lang="bash">		<source lang="bash">
	% nft add rule ip nat prerouting dnat ip saddr . tcp dport map { 1.1.1.1 . 80 : 192.168.1.100, 2.2.2.2 . 8888 : 192.168.1.101 }		% nft add rule ip nat prerouting dnat to ip saddr . tcp dport map { 1.1.1.1 . 80 : 192.168.1.100, 2.2.2.2 . 8888 : 192.168.1.101 }
	</source>		</source>

Fmyhr: /* Examples */ typo

2021-02-18T03:06:38Z

Examples: typo

← Older revision		Revision as of 03:06, 18 February 2021
Line 98:		Line 98:


	'''NOTE''': before ~~kinux~~ kernel 5.6 and nftables 0.9.4 the CIDR notation wasn't available, you would need to use a workaround:		'''NOTE''': before Linux kernel 5.6 and nftables 0.9.4 the CIDR notation wasn't available, you would need to use a workaround:

	<source lang="bash">		<source lang="bash">

Fmyhr: /* Interfaces */ Deleted sentence saying that iifname and oifname are not supported. They are now. When was support added?

2021-02-16T00:38:56Z

Interfaces: Deleted sentence saying that iifname and oifname are not supported. They are now. When was support added?

← Older revision		Revision as of 00:38, 16 February 2021
Line 121:		Line 121:
	% nft add rule tablename chainname iif . oif vmap { eth0 . eth1 : accept }		% nft add rule tablename chainname iif . oif vmap { eth0 . eth1 : accept }
	</source>		</source>

	~~Please note that using strings (for example iifname and oifname) and other variable sized data types is not supported yet.~~

	== Some ipset types ==		== Some ipset types ==

Fmyhr: dictionary -> verdict map

2021-02-12T10:37:55Z

dictionary -> verdict map

← Older revision		Revision as of 10:37, 12 February 2021
Line 1:		Line 1:
	Since Linux kernel 4.1, nftables supports concatenations.		Since Linux kernel 4.1, nftables supports concatenations.

	This new feature allows you to put two or more selectors together to perform very fast lookups ~~by combining them with~~ [[sets]], [[~~dictionaries~~]], [[~~maps~~]] and [[meters]].		This new feature allows you to put two or more selectors together to perform very fast lookups in [[sets]], [[maps]], [[Verdict_Maps_(vmaps) \| vmaps]] and [[meters]].

	= ~~Literal~~ sets =
			= Anonymous sets =

	<source lang="bash">		<source lang="bash">
Line 19:		Line 20:
	nftables updates the counter for this rule and then accepts the packet.		nftables updates the counter for this rule and then accepts the packet.

	~~= Dictionary declarations =~~

	The following example creates the ''whitelist'' ~~dictionary~~ using a concatenation of two selectors:		= Named verdict maps =

			The following example creates the ''whitelist'' vmap using a concatenation of two selectors:

	<source lang="bash">		<source lang="bash">
Line 27:		Line 29:
	</source>		</source>

	Once you create the ~~dictionary~~, you can use it from a rule that creates the following concatenation:		Once you create the vmap, you can use it from a rule that creates the following concatenation:

	<source lang="bash">		<source lang="bash">
Line 33:		Line 35:
	</source>		</source>

	~~Thus, the~~ rule above looks up ~~for~~ a verdict based on the source IP address AND the TCP destination port.		The rule above looks up a verdict based on the source IP address AND the TCP destination port.

	~~Since the dictionary~~ is initially empty~~, you~~ can dynamically populate ~~this dictionary~~ with elements ~~through~~:		The verdict map is initially empty. You can dynamically populate it with elements:

	<source lang="bash">		<source lang="bash">
Line 55:		Line 57:
	</source>		</source>

	= ~~Literal~~ maps =
			= Anonymous maps =

	The rule below determines the destination IP address that is used to perform DNAT to the packet based on:		The rule below determines the destination IP address that is used to perform DNAT to the packet based on:
Line 68:		Line 71:
	% nft add rule ip nat prerouting dnat ip saddr . tcp dport map { 1.1.1.1 . 80 : 192.168.1.100, 2.2.2.2 . 8888 : 192.168.1.101 }		% nft add rule ip nat prerouting dnat ip saddr . tcp dport map { 1.1.1.1 . 80 : 192.168.1.100, 2.2.2.2 . 8888 : 192.168.1.101 }
	</source>		</source>


	= Examples =		= Examples =
Line 75:		Line 79:
	== Network addresses ==		== Network addresses ==

	The example below implements a ~~dictionary~~ using network masks in each element:		The example below implements a vmap using network masks in each element:

	<source lang="bash">		<source lang="bash">

Arturo: /* Dictionary declarations */ mention some set options

2020-09-07T11:08:33Z

Dictionary declarations: mention some set options

@@ Line 39: / Line 39: @@
 <source lang="bash">
 % nft add element filter whitelist { 1.2.3.4 . 22 : accept}
 </source>

Arturo: /* Network addresses */ refresh example with interval contacts

2020-09-03T09:13:25Z

Network addresses: refresh example with interval contacts

@@ Line 61: / Line 61: @@
 == Network addresses ==
-The example below implements a dictionary using network masks as matching element.
+The example below implements a dictionary using network masks in each element:
 <source lang="bash">

Arturo: /* Some ipset types */ refactor examples into the moving from ipset to nftables page

2019-10-30T10:46:57Z

Some ipset types: refactor examples into the moving from ipset to nftables page

← Older revision		Revision as of 10:46, 30 October 2019
Line 92:		Line 92:
	Of course, you could implement these as named maps/sets as well.		Of course, you could implement these as named maps/sets as well.

			See examples in the [[Moving_from_ipset_to_nftables \| moving from ipset to nftables]] page.
	~~'''hash:net,net'''~~

	~~<source lang="bash">~~
	~~% nft add rule tablename chainname ip saddr and 255~~.~~255.255.0 . ip daddr and 255.255.255.0 vmap { 10.10.10.0 . 10.10.20.0 : accept }~~
	~~</source>~~

	~~'''hash:net,port,net'''~~

	~~<source lang="bash">~~
	~~% nft add rule tablename chainname ip saddr and 255.255.255.0 . tcp dport . ip daddr and 255.255.255.0 vmap { 10.10.10.0 . 80 . 10.10.20.0 : accept }~~
	~~</source>~~

	~~'''hash:net,iface'''~~

	~~<source lang="bash">~~
	~~% nft add rule tablename chainname ip saddr and 255.255.255.0 . iif vmap { 10.10.10.0 . eth0 : accept }~~
	~~</source>~~

Duncan: "packet is" should be "packet's" (i.e. belonging to the packet)

2018-08-14T08:08:04Z

"packet is" should be "packet's" (i.e. belonging to the packet)

← Older revision		Revision as of 08:08, 14 August 2018
Line 9:		Line 9:
	</source>		</source>

	So if the packet ~~matches~~ source IP address AND destination IP address AND level 4 protocol:		So if the packet's source IP address AND destination IP address AND level 4 protocol match:

	* 1.1.1.1 and 2.2.2.2 and TCP.		* 1.1.1.1 and 2.2.2.2 and TCP.

Duncan: TCP & UDP are level 4 protocols, not 3

2018-08-14T08:05:04Z

TCP & UDP are level 4 protocols, not 3

← Older revision		Revision as of 08:05, 14 August 2018
Line 9:		Line 9:
	</source>		</source>

	So if the packet is source IP address AND destination IP address AND level 3 protocol ~~match~~:		So if the packet matches source IP address AND destination IP address AND level 4 protocol:

	* 1.1.1.1 and 2.2.2.2 and TCP.		* 1.1.1.1 and 2.2.2.2 and TCP.

Duncan: There is nothing to do with ports here. We are matching on protocol only

2018-08-14T00:55:42Z

There is nothing to do with ports here. We are matching on protocol only

← Older revision		Revision as of 00:55, 14 August 2018
Line 9:		Line 9:
	</source>		</source>

	So if the packet is source IP address AND destination IP address AND ~~TCP destination port~~ match:		So if the packet is source IP address AND destination IP address AND level 3 protocol match:

	* 1.1.1.1 and 2.2.2.2 and TCP.		* 1.1.1.1 and 2.2.2.2 and TCP.