Skip to content

Commit c96d356

Browse files
committed
Fix ipv6 marking syntax. Create examples folder.
The idea is that further examples will are to be put inside examples/ to avoid cluttering the main README. Also fix an nft typo about ipv6 marking.
1 parent 9bfa6e4 commit c96d356

File tree

3 files changed

+41
-2
lines changed

3 files changed

+41
-2
lines changed

README.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ chain geoip-mark-output {
5858
type filter hook output priority -1; policy accept;
5959
6060
meta mark set ip daddr map @geoip4
61-
meta mark set ip daddr map @geoip6
61+
meta mark set ip6 daddr map @geoip6
6262
}
6363
```
6464

@@ -87,7 +87,7 @@ table inet geoip {
8787
type filter hook input priority -1; policy accept;
8888
8989
meta mark set ip saddr map @geoip4
90-
meta mark set ip saddr map @geoip6
90+
meta mark set ip6 saddr map @geoip6
9191
}
9292
9393
chain input {

examples/README.md

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
You can try out an example by executing it (probably you will need `sudo`).
2+
Assuming nft is located at `/usr/sbin`.
3+
4+
```
5+
sudo ./example.nft
6+
```
7+
8+
You can specify an additional folder for `nft` to lookup for files with `-I` so you
9+
don't need to modify the includes. This should be the folder in which you saved the
10+
script output.
11+
12+
```
13+
sudo ./example.nft [ -I path/to/script/output ]
14+
```

examples/accounting.nft

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#!/usr/sbin/nft -f
2+
3+
# Accounting of incoming Spanish traffic, ipv4 and ipv6
4+
5+
flush ruleset
6+
7+
table inet filter {
8+
9+
include "geoip-def-all.nft"
10+
include "geoip-ipv4.nft"
11+
include "geoip-ipv6.nft"
12+
13+
chain geoip-mark-input {
14+
type filter hook input priority -1; policy accept;
15+
16+
meta mark set ip saddr map @geoip4
17+
meta mark set ip6 saddr map @geoip6
18+
}
19+
20+
chain input {
21+
type filter hook input priority filter; policy accept;
22+
23+
mark $ES counter comment "incoming-ES"
24+
}
25+
}

0 commit comments

Comments
 (0)