Re: Masquerading with selectively open ports -- nftables

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, Oct 29, 2015 at 09:11:03AM +0100, Arturo Borrero Gonzalez wrote:
> On 29 October 2015 at 05:51, Johannes Ernst <johannes.ernst@xxxxxxxxx> wrote:
> >> On Oct 28, 2015, at 16:15, Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote:
[...]
> >> Moreover, make sure you also compiled masquerading support for nf_tables:
> >>
> >> CONFIG_NFT_MASQ=m
> >
> > Ahh, that might be it. The Arch build script is here [2] and I
> > don’t see anything that looks like CONFIG_NFT_MASQ. I’ll recompile
> > tomorrow and see where that leads us.
> >
> 
> this config option is from the linux kernel, for example:
> 
> % grep CONFIG_NFT_ /boot/config-4.2.0-1-amd64
> CONFIG_NFT_EXTHDR=m
> CONFIG_NFT_META=m
> CONFIG_NFT_CT=m
> CONFIG_NFT_RBTREE=m
> CONFIG_NFT_HASH=m
> CONFIG_NFT_COUNTER=m
> CONFIG_NFT_LOG=m
> CONFIG_NFT_LIMIT=m
> CONFIG_NFT_MASQ=m
> CONFIG_NFT_REDIR=m
> CONFIG_NFT_NAT=m
> CONFIG_NFT_QUEUE=m
> CONFIG_NFT_REJECT=m
> CONFIG_NFT_REJECT_INET=m
> CONFIG_NFT_COMPAT=m
> CONFIG_NFT_CHAIN_ROUTE_IPV4=m
> CONFIG_NFT_REJECT_IPV4=m
> CONFIG_NFT_CHAIN_NAT_IPV4=m
> CONFIG_NFT_MASQ_IPV4=m
> # CONFIG_NFT_REDIR_IPV4 is not set
> CONFIG_NFT_CHAIN_ROUTE_IPV6=m
> CONFIG_NFT_REJECT_IPV6=m
> CONFIG_NFT_CHAIN_NAT_IPV6=m
> CONFIG_NFT_MASQ_IPV6=m
> # CONFIG_NFT_REDIR_IPV6 is not set
> CONFIG_NFT_BRIDGE_META=m
> CONFIG_NFT_BRIDGE_REJECT=m

It would be good to have a sort of "compiling nf_tables kernel
support" on the wiki, in case anyone finds the time to contribute it.
We can use what Eric Leblond wrote time ago on his quick howto and
update it.

[...]
> In nftables tables has no special semantic apart of storing chains.
> Beware of families however, I doubt the inet family can hold NAT
> stuff.

I confirm this: We have no nat table for inet, only filter.
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux