Fmyhr: Initial page, using example from nftables 0.9.2 release notes.

2021-04-07T20:59:05Z

Initial page, using example from nftables 0.9.2 release notes.

New page

You can use a ''ct expectation'' object to create a [[Connection_Tracking_System|connection tracking]] expectation.

The ruleset below creates an expectation on destination port tcp/5432 for each new connection to port tcp/8888. This expectation expires after 1 hour and the maximum number of expectations that are pending to be confirmed are 12.

<source>
table ct_expect_demo {

ct expectation e_pgsql {
protocol tcp
dport 5432
timeout 1h
size 12
l3proto ip
}

chain input {
type filter hook input priority filter;

ct state new tcp dport 8888 ct expectation set "e_pgsql"
ct state established,related counter accept
}
}
</source>

Support for ''ct expectation'' was added in [https://marc.info/?l=netfilter&m=156621590113089&w=2 nftables 0.9.2].

Ct expectation - Revision history

Fmyhr: Initial page, using example from nftables 0.9.2 release notes.