☰

nftables 设置（动词）与连接

tag-icon • tag-icon nftables netfilter
nftables 设置（动词）与连接

笔记：这是关于使用 a 中的串联 ( .) 来set使用set动词来修改数据包的某些部分（例如ip daddr set 1.2.3.4）。貌似没找到具体的命名法手册页。

工作自这nftables我的配置中有以下摘录：

define src_net      = 192.168.1.0
define docker_dhcp  = 172.25.10.5
define WAN_MAC      = [REDACTED]

table netdev filterearly_lan {
    set dhcp_setting {
        typeof vlan id . ip saddr . ip daddr
        flags interval
        elements = {
            5 . $src_net . $docker_dhcp,
        }       
    }
    
    chain ingress {
        type filter hook ingress device eth0 priority -500; policy drop;

        #DHCPDISCOVER
        ether type 0x8100 vlan id . ip saddr 0.0.0.0 ether daddr ff:ff:ff:ff:ff:ff ip daddr 255.255.255.255 udp sport 68 udp dport 67 ether daddr set $WAN_MAC ip saddr set . ip daddr set @dhcp_setting meta pkttype set host ip length <= 590 accept;
    }
}

set但在尝试某些领域时它似乎不起作用：

# nft -f ./dhcp.rules
./dhcp.rules:323:167-167: Error: syntax error, unexpected .
                ether type 0x8100 vlan id . ip saddr 0.0.0.0 ether daddr ff:ff:ff:ff:ff:ff ip daddr 255.255.255.255 udp sport 68 udp dport 67 ether daddr set $WAN_MAC ip saddr set . ip daddr set @dhcp_setting meta pkttype set host ip length <= 590 accept;
                                                                                                                                                                                    ^

该规则旨在替换重复的规则集合：

ether type 0x8100 vlan id 5 ip saddr 0.0.0.0 ether daddr ff:ff:ff:ff:ff:ff ip daddr 255.255.255.255 udp sport 68 udp dport 67 ether daddr set $WAN_MAC ip saddr set $src_net ip daddr set $docker_dhcp meta pkttype set host ip length <= 590 accept;
...

版本信息：

# nft -v
nftables v1.0.6 (Lester Gooch #5)
# uname -r
6.1.0-11-amd64

以这种方式使用串联是否可能？谢谢

相关内容