File tree 3 files changed +41
-2
lines changed
3 files changed +41
-2
lines changed Original file line number Diff line number Diff line change @@ -58,7 +58,7 @@ chain geoip-mark-output {
58
58
type filter hook output priority -1; policy accept;
59
59
60
60
meta mark set ip daddr map @geoip4
61
- meta mark set ip daddr map @geoip6
61
+ meta mark set ip6 daddr map @geoip6
62
62
}
63
63
```
64
64
@@ -87,7 +87,7 @@ table inet geoip {
87
87
type filter hook input priority -1; policy accept;
88
88
89
89
meta mark set ip saddr map @geoip4
90
- meta mark set ip saddr map @geoip6
90
+ meta mark set ip6 saddr map @geoip6
91
91
}
92
92
93
93
chain input {
Original file line number Diff line number Diff line change
1
+ You can try out an example by executing it (probably you will need ` sudo ` ).
2
+ Assuming nft is located at ` /usr/sbin ` .
3
+
4
+ ```
5
+ sudo ./example.nft
6
+ ```
7
+
8
+ You can specify an additional folder for ` nft ` to lookup for files with ` -I ` so you
9
+ don't need to modify the includes. This should be the folder in which you saved the
10
+ script output.
11
+
12
+ ```
13
+ sudo ./example.nft [ -I path/to/script/output ]
14
+ ```
Original file line number Diff line number Diff line change
1
+ #!/usr/sbin/nft -f
2
+
3
+ # Accounting of incoming Spanish traffic, ipv4 and ipv6
4
+
5
+ flush ruleset
6
+
7
+ table inet filter {
8
+
9
+ include "geoip-def-all.nft"
10
+ include "geoip-ipv4.nft"
11
+ include "geoip-ipv6.nft"
12
+
13
+ chain geoip-mark-input {
14
+ type filter hook input priority -1; policy accept;
15
+
16
+ meta mark set ip saddr map @geoip4
17
+ meta mark set ip6 saddr map @geoip6
18
+ }
19
+
20
+ chain input {
21
+ type filter hook input priority filter; policy accept;
22
+
23
+ mark $ES counter comment "incoming-ES"
24
+ }
25
+ }
You can’t perform that action at this time.
0 commit comments