Fabian Bläse
157fa4eac5
Include nftables and appropriate modules. Translate ip- and ebtables rules to their nftables counterparts. Remove ip/ebtables and modules. This change intentionally tries to keep structural changes at a minimum to keep the rule translation comprehensible. kmod-nft-bridge is not required for fff-node, because it was merged into a single kernel module since Linux 4.17: [1]02c7b25e5f[2]fbaf48387eFixes: #252 Signed-off-by: Fabian Bläse <fabian@blaese.de> Co-authored-by: Johannes Kimmel <fff@bareminimum.eu>
45 lines
1.3 KiB
Plaintext
45 lines
1.3 KiB
Plaintext
nft -f - <<__EOF
|
|
table bridge filter {
|
|
# IN_ONLY wird angesprungen, wenn dieses Paket nur
|
|
# vom Gateway (also vom BATMAN) kommen darf.
|
|
chain IN_ONLY {
|
|
# -i ! bat0 --logical-in br-client -j DROP
|
|
iifname != "bat0" counter drop
|
|
counter
|
|
}
|
|
|
|
# OUT_ONLY wird angesprungen, wenn dieses Paket nur
|
|
# in Richtung Gateway (also ins BATMAN) gesendet werden darf.
|
|
chain OUT_ONLY {
|
|
# --logical-out br-client -o ! bat0 -j DROP
|
|
oifname != "bat0" counter drop
|
|
counter
|
|
}
|
|
|
|
# MULTICAST_OUT filtert/reduziert Multicast-Frames, die ins BATMAN gesendet werden.
|
|
chain MULTICAST_OUT {
|
|
}
|
|
|
|
chain INPUT {
|
|
type filter hook input priority filter; policy accept;
|
|
|
|
# -d Multicast -i ! bat0 --logical-in br-client -j ACCEPT
|
|
iifname != "bat0" ether daddr & 01:00:00:00:00:00 == 01:00:00:00:00:00 counter packets 0 bytes 0 accept
|
|
}
|
|
|
|
chain FORWARD {
|
|
type filter hook forward priority filter; policy accept;
|
|
|
|
# -d Multicast --logical-out br-client -o bat0 -j MULTICAST_OUT
|
|
oifname "bat0" ether daddr & 01:00:00:00:00:00 == 01:00:00:00:00:00 counter packets 0 bytes 0 jump MULTICAST_OUT
|
|
}
|
|
|
|
chain OUTPUT {
|
|
type filter hook output priority filter; policy accept;
|
|
|
|
# -d Multicast --logical-out br-client -o bat0 -j MULTICAST_OUT
|
|
oifname "bat0" ether daddr & 01:00:00:00:00:00 == 01:00:00:00:00:00 counter jump MULTICAST_OUT
|
|
}
|
|
}
|
|
__EOF
|