![nftables 设置(动词)与连接](https://linux22.com/image/225020/nftables%20%E8%AE%BE%E7%BD%AE%EF%BC%88%E5%8A%A8%E8%AF%8D%EF%BC%89%E4%B8%8E%E8%BF%9E%E6%8E%A5.png)
笔记:这是关于使用 a 中的串联 ( .
) 来set
使用set
动词来修改数据包的某些部分(例如ip daddr set 1.2.3.4
)。貌似没找到具体的命名法手册页。
工作自这nftables
我的配置中有以下摘录:
define src_net = 192.168.1.0
define docker_dhcp = 172.25.10.5
define WAN_MAC = [REDACTED]
table netdev filterearly_lan {
set dhcp_setting {
typeof vlan id . ip saddr . ip daddr
flags interval
elements = {
5 . $src_net . $docker_dhcp,
}
}
chain ingress {
type filter hook ingress device eth0 priority -500; policy drop;
#DHCPDISCOVER
ether type 0x8100 vlan id . ip saddr 0.0.0.0 ether daddr ff:ff:ff:ff:ff:ff ip daddr 255.255.255.255 udp sport 68 udp dport 67 ether daddr set $WAN_MAC ip saddr set . ip daddr set @dhcp_setting meta pkttype set host ip length <= 590 accept;
}
}
set
但在尝试某些领域时它似乎不起作用:
# nft -f ./dhcp.rules
./dhcp.rules:323:167-167: Error: syntax error, unexpected .
ether type 0x8100 vlan id . ip saddr 0.0.0.0 ether daddr ff:ff:ff:ff:ff:ff ip daddr 255.255.255.255 udp sport 68 udp dport 67 ether daddr set $WAN_MAC ip saddr set . ip daddr set @dhcp_setting meta pkttype set host ip length <= 590 accept;
^
该规则旨在替换重复的规则集合:
ether type 0x8100 vlan id 5 ip saddr 0.0.0.0 ether daddr ff:ff:ff:ff:ff:ff ip daddr 255.255.255.255 udp sport 68 udp dport 67 ether daddr set $WAN_MAC ip saddr set $src_net ip daddr set $docker_dhcp meta pkttype set host ip length <= 590 accept;
...
版本信息:
# nft -v
nftables v1.0.6 (Lester Gooch #5)
# uname -r
6.1.0-11-amd64
以这种方式使用串联是否可能?谢谢