• Anders K. Pedersen's avatar
    netfilter: nf_tables: introduce routing expression · 2fa84193
    Anders K. Pedersen authored
    Introduces an nftables rt expression for routing related data with support
    for nexthop (i.e. the directly connected IP address that an outgoing packet
    is sent to), which can be used either for matching or accounting, eg.
    
     # nft add rule filter postrouting \
    	ip daddr 192.168.1.0/24 rt nexthop != 192.168.0.1 drop
    
    This will drop any traffic to 192.168.1.0/24 that is not routed via
    192.168.0.1.
    
     # nft add rule filter postrouting \
    	flow table acct { rt nexthop timeout 600s counter }
     # nft add rule ip6 filter postrouting \
    	flow table acct { rt nexthop timeout 600s counter }
    
    These rules count outgoing traffic per nexthop. Note that the timeout
    releases an entry if no traffic is seen for this nexthop within 10 minutes.
    
     # nft add rule inet filter postrouting \
    	ether type ip \
    	flow table acct { rt nexthop timeout 600s counter }
     # nft add rule inet filter postrouting \
    	ether type ip6 \
    	flow table acct { rt nexthop timeout 600s counter }
    
    Same as above, but via the inet family, where the ether type must be
    specified explicitly.
    
    "rt classid" is also implemented identical to "meta rtclassid", since it
    is more logical to have this match in the routing expression going forward.
    Signed-off-by: default avatarAnders K. Pedersen <akp@cohaesio.com>
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    2fa84193
Kconfig 49.1 KB