[prev in list] [next in list] [prev in thread] [next in thread] 

List:       netfilter-devel
Subject:    Re: nftables: problem with sets (Object not found)
From:       "Christoph A." <casmls () gmail ! com>
Date:       2009-07-28 20:13:50
Message-ID: 4A6F5BFE.9070807 () gmail ! com
[Download RAW message or body]

[Attachment #2 (multipart/mixed)]


On 28.07.2009 14:23, Patrick McHardy wrote:
> I never pushed out the userspace changes for the new set API.
> I just pushed out all the changes that should be needed, please
> update your trees and try again.
>=20

pulled, compiled, works.

thanks!
Christoph A.

nft -f main1
insert: [c0a80100 c0a801ff]
insert: [2020202 2020202]
insert: [c0a83801 c0a83801]
iter: [2020202 2020202]
iter: [c0a80100 c0a801ff]
iter: [c0a83801 c0a83801]
list: [00000000 02020201]
list: [02020202 02020202]
list: [02020203 c0a800ff]
list: [c0a80100 c0a801ff]
list: [c0a80200 c0a83800]
list: [c0a83801 c0a83801]
list: [c0a83802 ffffffff]
{ 0.0.0.0, 2.2.2.2, 2.2.2.3, 192.168.1.0, 192.168.2.0, 192.168.56.1,
192.168.56.2}

(I guess the second IPs ...2.3, ..2.0, ..56.2 are the upper bound of the
range)

["main1" (text/plain)]

define sshclient = 192.168.56.1
define foo = 2.2.2.2
define localnet = 192.168.1.0/24
define allowed_ssh_hosts = { $sshclient, $foo, $localnet }

define sshport = 22
define httpport = 999

flush table filter
delete table filter

table filter {
	
	chain input {
		hook NF_INET_LOCAL_IN 0

		ct state related,established accept
		#ip saddr { $sshclient, $foo, $localnet } tcp dport $sshport ct state new accept
		ip saddr $allowed_ssh_hosts tcp dport $sshport ct state new accept
		ip saddr $sshclient tcp dport $httpport ct state new accept
		drop
	}

	chain output {
		hook NF_INET_LOCAL_OUT 0
		ct state related,established accept
		drop
	}
}

["signature.asc" (application/pgp-signature)]
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[prev in list] [next in list] [prev in thread] [next in thread]