From: Pascal Hambourg <pascal.mail@plouf.fr.eu.org>
To: "H. Peter Anvin" <hpa@zytor.com>
Cc: Jan Engelhardt <jengelh@medozas.de>,
David Miller <davem@davemloft.net>,
netfilter-devel@vger.kernel.org
Subject: Re: rules matching ipv6 prefix addrs
Date: Thu, 04 Nov 2010 21:00:24 +0100 [thread overview]
Message-ID: <4CD310D8.2010003@plouf.fr.eu.org> (raw)
In-Reply-To: <4CD2C647.2000608@zytor.com>
H. Peter Anvin a écrit :
>>>
>>> Now, the upstream (ISP-assigned) prefix changes to 2001:6b2f:1705::/48.
>>> RA will handle reassigning addresses to actual downstream hosts, but
>>> things that explicitly encode IPv6 addresses need to be changed, and
>>> that includes ip6tables, in this case these rules now need to refer to
>>> 2001:6b2f:1705:0000::/52, 2001:62bf:1705:1000::/52 and so on.
>>
>> Are you talking about rules on the router which subnets the block, or on
>> downstream hosts ?
>> Also, is each subnet prefix on a separate link ?
>> Could you provide an example of such rules ?
>
> I'm talking about rules on the internal router(s) which separate the
> security domains.
Isn't it enough to match the input and/or output interface(s) ?
> I can probably come up with a concrete ruleset, but
> it'll take a few days since I'm travelling at the moment.
I am not asking for a complete ruleset, rather a few sample rules and
their purpose.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2010-11-04 20:00 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-11-02 20:52 rules matching ipv6 prefix addrs David Miller
2010-11-02 21:24 ` Maciej Żenczykowski
2010-11-03 7:37 ` Patrick McHardy
2010-11-03 9:29 ` Pascal Hambourg
2010-11-03 10:51 ` Jan Engelhardt
2010-11-03 12:19 ` David Miller
2010-11-03 12:32 ` Jan Engelhardt
2010-11-03 21:55 ` David Miller
2010-11-03 22:36 ` H. Peter Anvin
2010-11-03 22:52 ` Jan Engelhardt
2010-11-04 2:12 ` H. Peter Anvin
2010-11-04 4:14 ` Patrick McHardy
2010-11-04 8:58 ` Jan Engelhardt
2010-11-04 11:36 ` H. Peter Anvin
2010-11-04 11:53 ` Jan Engelhardt
2010-11-04 14:41 ` H. Peter Anvin
2010-11-04 20:02 ` Pascal Hambourg
2010-11-04 12:07 ` Pascal Hambourg
2010-11-04 11:08 ` Stephen Clark
2010-11-04 11:29 ` Pascal Hambourg
2010-11-04 12:07 ` Stephen Clark
2010-11-04 12:19 ` Pascal Hambourg
2010-11-04 13:34 ` Jozsef Kadlecsik
2010-11-04 14:41 ` H. Peter Anvin
2010-11-04 17:35 ` Jeff Haran
2010-11-04 18:45 ` H. Peter Anvin
2010-11-04 19:24 ` Jan Engelhardt
2010-11-04 19:26 ` H. Peter Anvin
2010-11-04 11:55 ` Pascal Hambourg
2010-11-04 14:42 ` H. Peter Anvin
2010-11-04 20:00 ` Pascal Hambourg [this message]
2010-11-03 12:56 ` Pascal Hambourg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4CD310D8.2010003@plouf.fr.eu.org \
--to=pascal.mail@plouf.fr.eu.org \
--cc=davem@davemloft.net \
--cc=hpa@zytor.com \
--cc=jengelh@medozas.de \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).