All of lore.kernel.org
 help / color / mirror / Atom feed
From: FaTe <gokuvsvegita@gmail.com>
To: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: netfilter-devel@vger.kernel.org
Subject: Regarding libxt_multiport translation in nft
Date: Wed, 9 Mar 2016 12:35:55 +0530	[thread overview]
Message-ID: <56DFCB53.8090601@gmail.com> (raw)
In-Reply-To: <20160308105346.GB4008@salvia>

Hello Pablo,

I would require some guidance regarding the libxt_multiport translation in nft.

If the translation is over ip4 family :
$ iptables-translate -A INPUT -p tcp -m multiport --ports 3:4  -j ACCEPT
nft add rule ip filter INPUT ip protocol tcp dport { 3-4 } tcp sport { 3-4 } counter accept
		             ^^^^^^^^^^^
			     this causes problem.
Similarly for ipv6 :
$ ip6tables-translate -A input -p tcp -m multiport --dports 1024:2048,2049:3333 -j ACCEPT
nft add rule ip6 filter input meta l4proto tcp dport { 1024-2048,2049-3333 } counter accept
			      ^^^^^^^^^^^^
			      this is causing problem.

both the strings "ip protocol" and "meta l4proto" is not introduced by libxt_multiport.
And in the absence of both , the command works.

For example , 
$ nft add rule ip filter INPUT tcp dport { 3-4 } tcp sport { 3-4 } counter accept

$ nft add rule ip6 filter input tcp dport { 1024-2048,2049-3333 } counter accept

Any comment regarding this behaviour ?

  parent reply	other threads:[~2016-03-09  7:05 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-03-07 21:21 [PATCHv3] extensions: libipt_icmp: Add translation to nft Laura Garcia Liebana
2016-03-08 10:53 ` Pablo Neira Ayuso
2016-03-09  6:58   ` [PATCH] libxt_multiport: " FaTe
2016-03-09 12:32     ` Pablo Neira Ayuso
2016-03-09 14:37       ` Piyush Pangtey
2016-03-09 14:39       ` [PATCH v2] " Piyush Pangtey
2016-03-09 17:30         ` Pablo Neira Ayuso
2016-03-10 12:50           ` [PATCH v3] " Piyush Pangtey
2016-03-10 18:31             ` Pablo Neira Ayuso
2016-03-09  7:05   ` FaTe [this message]
2016-03-09 10:06     ` Regarding libxt_multiport translation in nft Arturo Borrero Gonzalez
2016-03-09 14:34       ` Piyush Pangtey
2016-03-09  7:12   ` [PATCH] libip6t_hbh: Add translation to nft FaTe
2016-03-10 18:47     ` Pablo Neira Ayuso

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=56DFCB53.8090601@gmail.com \
    --to=gokuvsvegita@gmail.com \
    --cc=netfilter-devel@vger.kernel.org \
    --cc=pablo@netfilter.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.