45 lines
1.4 KiB
Plaintext
45 lines
1.4 KiB
Plaintext
nft -f - <<__EOF
|
|
table bridge filter {
|
|
# IN_ONLY wird angesprungen, wenn dieses Paket nur
|
|
# vom Gateway (also vom BATMAN) kommen darf.
|
|
chain IN_ONLY {
|
|
# -i ! bat0 --logical-in br-client -j DROP
|
|
iifname != "bat0" ibrname "br-client" counter drop
|
|
counter
|
|
}
|
|
|
|
# OUT_ONLY wird angesprungen, wenn dieses Paket nur
|
|
# in Richtung Gateway (also ins BATMAN) gesendet werden darf.
|
|
chain OUT_ONLY {
|
|
# --logical-out br-client -o ! bat0 -j DROP
|
|
oifname != "bat0" obrname "br-client" counter drop
|
|
counter
|
|
}
|
|
|
|
# MULTICAST_OUT filtert/reduziert Multicast-Frames, die ins BATMAN gesendet werden.
|
|
chain MULTICAST_OUT {
|
|
}
|
|
|
|
chain INPUT {
|
|
type filter hook input priority filter; policy accept;
|
|
|
|
# -d Multicast -i ! bat0 --logical-in br-client -j ACCEPT
|
|
iifname != "bat0" ether daddr & 01:00:00:00:00:00 == 01:00:00:00:00:00 ibrname "br-client" counter packets 0 bytes 0 accept
|
|
}
|
|
|
|
chain FORWARD {
|
|
type filter hook forward priority filter; policy accept;
|
|
|
|
# -d Multicast --logical-out br-client -o bat0 -j MULTICAST_OUT
|
|
oifname "bat0" obrname "br-client" ether daddr & 01:00:00:00:00:00 == 01:00:00:00:00:00 counter packets 0 bytes 0 jump MULTICAST_OUT
|
|
}
|
|
|
|
chain OUTPUT {
|
|
type filter hook output priority filter; policy accept;
|
|
|
|
# -d Multicast --logical-out br-client -o bat0 -j MULTICAST_OUT
|
|
oifname "bat0" obrname "br-client" ether daddr & 01:00:00:00:00:00 == 01:00:00:00:00:00 counter jump MULTICAST_OUT
|
|
}
|
|
}
|
|
__EOF
|