Difference between revisions of "Intervals"

From nftables wiki
Jump to navigation Jump to search
(Created page with "Intervals are expressed as value-value. The following example show how to drop the traffic coming the range 192.168.0.1 to 192.168.0.250: <source lang="bash"> % nft add rule...")
 
(dictionaries -> verdict maps)
Line 21: Line 21:
</source>
</source>


And you can also use them in [[dictionaries]]:
And you can also use them in [[Verdict_Maps_(vmaps) | verdict&nbsp;maps]]:


<source lang="bash">
<source lang="bash">
% nft add rule ip filter forward ip daddr vmap { 192.168.1.1-192.168.1.200 : jump chain-dmz, 192.168.2.1-192.168.20.250 : jump chain-desktop }
% nft add rule ip filter forward ip daddr vmap { 192.168.1.1-192.168.1.200 : jump chain-dmz, 192.168.2.1-192.168.20.250 : jump chain-desktop }
</source>
</source>

Revision as of 11:50, 12 February 2021

Intervals are expressed as value-value.

The following example show how to drop the traffic coming the range 192.168.0.1 to 192.168.0.250:

% nft add rule filter input ip daddr 192.168.0.1-192.168.0.250 drop

You can also use it with TCP ports:

% nft add rule filter input tcp ports 1-1024 drop

And any sort of constant value.

You can also use intervals from sets, the following example shows how to blacklist two interval of IP addresses:

% nft add rule ip filter input ip saddr { 192.168.1.1-192.168.1.200, 192.168.2.1-192.168.2.200 } drop

And you can also use them in verdict maps:

% nft add rule ip filter forward ip daddr vmap { 192.168.1.1-192.168.1.200 : jump chain-dmz, 192.168.2.1-192.168.20.250 : jump chain-desktop }