git.ipfire.org Git - thirdparty/iptables.git/commit

author	Liping Zhang <zlpnobody@gmail.com>
	Sun, 25 Dec 2016 12:27:51 +0000 (20:27 +0800)
committer	Pablo Neira Ayuso <pablo@netfilter.org>
	Mon, 16 Jan 2017 13:12:22 +0000 (14:12 +0100)
commit	aa98227ce600cf52dbcf41e26002db1f5395a871
tree	4a091e8380a20c30eaf3947f583807baf9cd213e	tree \| snapshot
parent	b013e3e80e96fdf3ab77d827943bfacdfca38618	commit \| diff

extensions: libxt_connbytes: Add translation to nft

For example:
  # iptables-translate -A OUTPUT -m connbytes --connbytes 200 \
  --connbytes-dir original --connbytes-mode packets
  nft add rule ip filter OUTPUT ct original packets ge 200 counter

  # iptables-translate -A OUTPUT -m connbytes ! --connbytes 200 \
  --connbytes-dir reply --connbytes-mode packets
  nft add rule ip filter OUTPUT ct reply packets lt 200 counter

  # iptables-translate -A OUTPUT -m connbytes --connbytes 200:600 \
  --connbytes-dir both --connbytes-mode bytes
  nft add rule ip filter OUTPUT ct bytes 200-600 counter

  # iptables-translate -A OUTPUT -m connbytes ! --connbytes 200:600 \
  --connbytes-dir both --connbytes-mode bytes
  nft add rule ip filter OUTPUT ct bytes != 200-600 counter

  # iptables-translate -A OUTPUT -m connbytes --connbytes 200:200 \
  --connbytes-dir both --connbytes-mode avgpkt
  nft add rule ip filter OUTPUT ct avgpkt 200 counter

Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>