a2ea441692
- Install an improved sample config - Fix permissions of osf-related configs - rule: Fix for potential off-by-one in cmd_add_loc() - netlink_delinearize: Fix suspicious calloc() call - netlink: Avoid memleak in error path of netlink_delinearize_obj() - netlink: Avoid memleak in error path of netlink_delinearize_table() - netlink: Avoid memleak in error path of netlink_delinearize_chain() - netlink: Avoid memleak in error path of netlink_delinearize_set() - json: Drop pointless assignment in exthdr_expr_json() - evaluate: Mark fall through case in str2hooknum() - parser_json: Fix for memleak in tcp option error path - parser_bison: Fix for implicit declaration of isalnum - main: fix nft --help output fallout from 719e4427 - tests: add icmp/6 test where dependency should be left alone - payload: check icmp dependency before removing previous icmp expression Resolves: rhbz#1933117, rhbz#1938823, rhbz#1931790, rhbz#1964987, rhbz#1971600
31 lines
743 B
Plaintext
31 lines
743 B
Plaintext
# Sample configuration snippet for nftables service.
|
|
# Meant to be included by main.nft, not for direct use.
|
|
|
|
# dedicated table for IPv4
|
|
table ip nftables_svc {
|
|
|
|
# interfaces to masquerade traffic from
|
|
set masq_interfaces {
|
|
type ifname
|
|
elements = { "virbr0" }
|
|
}
|
|
|
|
# networks to masquerade traffic from
|
|
# 'interval' flag is required to support subnets
|
|
set masq_ips {
|
|
type ipv4_addr
|
|
flags interval
|
|
elements = { 192.168.122.0/24 }
|
|
}
|
|
|
|
# base-chain to manipulate conntrack in postrouting,
|
|
# will see packets for new or related traffic only
|
|
chain POSTROUTING {
|
|
type nat hook postrouting priority srcnat + 20
|
|
policy accept
|
|
|
|
iifname @masq_interfaces oifname != @masq_interfaces masquerade
|
|
ip saddr @masq_ips masquerade
|
|
}
|
|
}
|