ipv6-nat.nft \
ipv6-raw.nft \
netdev-ingress.nft
-
-install-data-hook:
- ${SED} -i 's|@sbindir[@]|${sbindir}/|g' ${DESTDIR}${pkgsysconfdir}/*.nft
-#!@sbindir@nft -f
-
# Here is an example of different families, hooks and priorities in the
# nftables framework, all mixed together.
#
# more examples are located in files/examples in nftables source.
# For up-to-date information please visit https://wiki.nftables.org
#
-# This script is mean to be loaded with `nft -f <file>`
+# This script is meant to be loaded with `nft -f <file>`
# clear all prior state
flush ruleset
-#!@sbindir@nft -f
-
table arp filter {
chain input { type filter hook input priority 0; }
chain output { type filter hook output priority 0; }
-#!@sbindir@nft -f
-
table bridge filter {
chain input { type filter hook input priority -200; }
chain forward { type filter hook forward priority -200; }
-#!@sbindir@nft -f
-
table inet filter {
chain input { type filter hook input priority 0; }
chain forward { type filter hook forward priority 0; }
-#!@sbindir@nft -f
-
table inet nat {
chain prerouting { type nat hook prerouting priority -100; }
chain input { type nat hook input priority 100; }
-#!@sbindir@nft -f
-
table filter {
chain input { type filter hook input priority 0; }
chain forward { type filter hook forward priority 0; }
-#!@sbindir@nft -f
-
table mangle {
chain output { type route hook output priority -150; }
}
-#!@sbindir@nft -f
-
table nat {
chain prerouting { type nat hook prerouting priority -100; }
chain input { type nat hook input priority 100; }
-#!@sbindir@nft -f
-
table raw {
chain prerouting { type filter hook prerouting priority -300; }
chain output { type filter hook output priority -300; }
-#!@sbindir@nft -f
-
table ip6 filter {
chain input { type filter hook input priority 0; }
chain forward { type filter hook forward priority 0; }
-#!@sbindir@nft -f
-
table ip6 mangle {
chain output { type route hook output priority -150; }
}
-#!@sbindir@nft -f
-
table ip6 nat {
chain prerouting { type nat hook prerouting priority -100; }
chain input { type nat hook input priority 100; }
-#!@sbindir@nft -f
-
table ip6 raw {
chain prerouting { type filter hook prerouting priority -300; }
chain output { type filter hook output priority -300; }
-#!@sbindir@nft -f
-
-# mind the NIC, it must exists
+# mind the NIC, it must exist
table netdev filter {
chain loinput { type filter hook ingress device lo priority 0; }
}
projects / thirdparty / nftables.git / commitdiff
