Re: [PATCH v4 nf-next] netfilter: nft: introduce routing expression

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Fri, Oct 28, 2016 at 05:54:15AM +0000, Anders K. Pedersen | Cohaesio wrote:
> From: Anders K. Pedersen <akp@cohaesio.com>
> 
> Introduces an nftables rt expression for routing related data with support
> for nexthop (i.e. the directly connected IP address that an outgoing packet
> is sent to), which can be used either for matching or accounting, eg.
> 
>  # nft add rule filter postrouting \
> 	ip daddr 192.168.1.0/24 rt nexthop != 192.168.0.1 drop
> 
> This will drop any traffic to 192.168.1.0/24 that is not routed via
> 192.168.0.1.
> 
>  # nft add rule filter postrouting \
> 	flow table acct { rt nexthop timeout 600s counter }
>  # nft add rule ip6 filter postrouting \
> 	flow table acct { rt nexthop timeout 600s counter }
> 
> These rules count outgoing traffic per nexthop. Note that the timeout
> releases an entry if no traffic is seen for this nexthop within 10 minutes.
> 
>  # nft add rule inet filter postrouting \
> 	ether type ip \
> 	flow table acct { rt nexthop timeout 600s counter }
>  # nft add rule inet filter postrouting \
> 	ether type ip6 \
> 	flow table acct { rt nexthop timeout 600s counter }
> 
> Same as above, but via the inet family, where the ether type must be
> specified explicitly.
> 
> "rt classid" is also implemented identical to "meta rtclassid", since it
> is more logical to have this match in the routing expression going forward.

Applied, thanks Anders!