libvirt/tests/networkxml2firewalldata/nat-ipv6-linux.nftables
Laine Stump a4f38f6ffe network: use iif/oif instead of iifname/oifname in nftables rules
iifname/oifname need to lookup the string that contains the name of
the interface each time a packet is checked, while iif/oif compare the
ifindex of the interface, which is included directly in the
packet. Conveniently, the rule is created using the *name* of the
interface (which gets converted to ifindex as the rule is added), so
no extra work is required other than changing the commandline option.

If it was the case that the interface could be deleted and re-added
during the life of the rule, we would have to use Xifname (since
deleting and re-adding the interface would result in ifindex
changing), but for our uses this never happens, so Xif works for us,
and undoubtedly improves performance by at least 0.0000001%.

Signed-off-by: Laine Stump <laine@redhat.com>
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
2024-05-27 23:53:58 +02:00

203 lines
1.9 KiB
Plaintext

nft \
-ae insert \
rule \
ip \
libvirt_network \
guest_output \
iif \
virbr0 \
counter \
reject
nft \
-ae insert \
rule \
ip \
libvirt_network \
guest_input \
oif \
virbr0 \
counter \
reject
nft \
-ae insert \
rule \
ip \
libvirt_network \
guest_cross \
iif \
virbr0 \
oif \
virbr0 \
counter \
accept
nft \
-ae insert \
rule \
ip6 \
libvirt_network \
guest_output \
iif \
virbr0 \
counter \
reject
nft \
-ae insert \
rule \
ip6 \
libvirt_network \
guest_input \
oif \
virbr0 \
counter \
reject
nft \
-ae insert \
rule \
ip6 \
libvirt_network \
guest_cross \
iif \
virbr0 \
oif \
virbr0 \
counter \
accept
nft \
-ae insert \
rule \
ip \
libvirt_network \
guest_output \
ip \
saddr \
192.168.122.0/24 \
iif \
virbr0 \
counter \
accept
nft \
-ae insert \
rule \
ip \
libvirt_network \
guest_input \
oif \
virbr0 \
ip \
daddr \
192.168.122.0/24 \
ct \
state \
related,established \
counter \
accept
nft \
-ae insert \
rule \
ip \
libvirt_network \
guest_nat \
ip \
saddr \
192.168.122.0/24 \
ip \
daddr \
'!=' \
192.168.122.0/24 \
counter \
masquerade
nft \
-ae insert \
rule \
ip \
libvirt_network \
guest_nat \
meta \
l4proto \
udp \
ip \
saddr \
192.168.122.0/24 \
ip \
daddr \
'!=' \
192.168.122.0/24 \
counter \
masquerade \
to \
:1024-65535
nft \
-ae insert \
rule \
ip \
libvirt_network \
guest_nat \
meta \
l4proto \
tcp \
ip \
saddr \
192.168.122.0/24 \
ip \
daddr \
'!=' \
192.168.122.0/24 \
counter \
masquerade \
to \
:1024-65535
nft \
-ae insert \
rule \
ip \
libvirt_network \
guest_nat \
ip \
saddr \
192.168.122.0/24 \
ip \
daddr \
255.255.255.255/32 \
counter \
return
nft \
-ae insert \
rule \
ip \
libvirt_network \
guest_nat \
ip \
saddr \
192.168.122.0/24 \
ip \
daddr \
224.0.0.0/24 \
counter \
return
nft \
-ae insert \
rule \
ip6 \
libvirt_network \
guest_output \
ip6 \
saddr \
2001:db8:ca2:2::/64 \
iif \
virbr0 \
counter \
accept
nft \
-ae insert \
rule \
ip6 \
libvirt_network \
guest_input \
ip6 \
daddr \
2001:db8:ca2:2::/64 \
oif \
virbr0 \
counter \
accept