Fabian Bläse
157fa4eac5
Include nftables and appropriate modules. Translate ip- and ebtables rules to their nftables counterparts. Remove ip/ebtables and modules. This change intentionally tries to keep structural changes at a minimum to keep the rule translation comprehensible. kmod-nft-bridge is not required for fff-node, because it was merged into a single kernel module since Linux 4.17: [1]02c7b25e5f[2]fbaf48387eFixes: #252 Signed-off-by: Fabian Bläse <fabian@blaese.de> Co-authored-by: Johannes Kimmel <fff@bareminimum.eu>
20 lines
524 B
Plaintext
20 lines
524 B
Plaintext
nft -f - <<__EOF
|
|
table bridge filter {
|
|
chain MULTICAST_OUT {
|
|
# Erlaube DHCP Requests
|
|
# -p IPv4 --ip-proto udp --ip-dport 67 -j RETURN
|
|
ether type ip udp dport 67 counter return
|
|
}
|
|
|
|
chain FORWARD {
|
|
# Erlaube nur DHCP Request von CLIENT -> BATMAN
|
|
# -p IPv4 --ip-proto udp --ip-dport 67 -j OUT_ONLY
|
|
ether type ip udp dport 67 counter jump OUT_ONLY
|
|
|
|
# Erlaube nur DHCP Antworten von BATMAN -> CLIENT
|
|
# -p IPv4 --ip-proto udp --ip-dport 68 -j IN_ONLY
|
|
ether type ip udp dport 68 counter jump IN_ONLY
|
|
}
|
|
}
|
|
__EOF
|