|
 |
bacbc8 |
From 1ac8084be4f5a66f078fb346c7dee618ce2d217e Mon Sep 17 00:00:00 2001
|
|
|
bacbc8 |
From: Phil Sutter <psutter@redhat.com>
|
|
|
bacbc8 |
Date: Thu, 4 Apr 2019 13:02:55 +0200
|
|
|
bacbc8 |
Subject: [PATCH] doc: Add minimal description of (v)map statements
|
|
|
bacbc8 |
|
|
|
bacbc8 |
Although quite useful, these were missing in man page. Content loosely
|
|
|
bacbc8 |
based on wiki documentation.
|
|
|
bacbc8 |
|
|
|
bacbc8 |
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
|
bacbc8 |
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
bacbc8 |
(cherry picked from commit 3b29acc8f29944c5cf34259f2e2b5b40b4d0ccdd)
|
|
|
bacbc8 |
|
|
|
bacbc8 |
Conflicts:
|
|
|
bacbc8 |
-> Changes applied manually, upstream merged to asciidoc.
|
|
|
bacbc8 |
|
|
|
bacbc8 |
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
|
|
bacbc8 |
---
|
|
|
bacbc8 |
doc/nft.xml | 66 +++++++++++++++++++++++++++++++++++++++++++++++++++++
|
|
|
bacbc8 |
1 file changed, 66 insertions(+)
|
|
|
bacbc8 |
|
|
|
bacbc8 |
diff --git a/doc/nft.xml b/doc/nft.xml
|
|
|
bacbc8 |
index ea3973e1b8f1a..9acff09e30619 100644
|
|
|
bacbc8 |
--- a/doc/nft.xml
|
|
|
bacbc8 |
+++ b/doc/nft.xml
|
|
|
bacbc8 |
@@ -5535,6 +5535,72 @@ dup to ip daddr map { 192.168.7.1 : "eth0", 192.168.7.2 : "eth1" }
|
|
|
bacbc8 |
</example>
|
|
|
bacbc8 |
</para>
|
|
|
bacbc8 |
</refsect2>
|
|
|
bacbc8 |
+
|
|
|
bacbc8 |
+ <refsect2>
|
|
|
bacbc8 |
+ <title>Map statement</title>
|
|
|
bacbc8 |
+ <para>
|
|
|
bacbc8 |
+ The map statement is used to lookup data based on some specific input key.
|
|
|
bacbc8 |
+ </para>
|
|
|
bacbc8 |
+ <para>
|
|
|
bacbc8 |
+ <cmdsynopsis>
|
|
|
bacbc8 |
+ <replaceable>expression</replaceable>
|
|
|
bacbc8 |
+ <command>map {</command>
|
|
|
bacbc8 |
+ <replaceable>key</replaceable>
|
|
|
bacbc8 |
+ <command>:</command>
|
|
|
bacbc8 |
+ <replaceable>value</replaceable>
|
|
|
bacbc8 |
+ <arg choice="opt" rep="repeat">
|
|
|
bacbc8 |
+ <command>,</command>
|
|
|
bacbc8 |
+ <replaceable>key</replaceable>
|
|
|
bacbc8 |
+ <command>:</command>
|
|
|
bacbc8 |
+ <replaceable>value</replaceable>
|
|
|
bacbc8 |
+ </arg>
|
|
|
bacbc8 |
+ <command>}</command>
|
|
|
bacbc8 |
+ </cmdsynopsis>
|
|
|
bacbc8 |
+ </para>
|
|
|
bacbc8 |
+ <example>
|
|
|
bacbc8 |
+ <title>using the map statement</title>
|
|
|
bacbc8 |
+ <programlisting>
|
|
|
bacbc8 |
+# select DNAT target based on TCP dport:
|
|
|
bacbc8 |
+# connections to port 80 are redirected to 192.168.1.100,
|
|
|
bacbc8 |
+# connections to port 8888 are redirected to 192.168.1.101
|
|
|
bacbc8 |
+nft add rule ip nat prerouting dnat tcp dport map { 80 : 192.168.1.100, 8888 : 192.168.1.101 }
|
|
|
bacbc8 |
+
|
|
|
bacbc8 |
+# source address based SNAT:
|
|
|
bacbc8 |
+# packets from net 192.168.1.0/24 will appear as originating from 10.0.0.1,
|
|
|
bacbc8 |
+# packets from net 192.168.2.0/24 will appear as originating from 10.0.0.2
|
|
|
bacbc8 |
+nft add rule ip nat postrouting snat to ip saddr map { 192.168.1.0/24 : 10.0.0.1, 192.168.2.0/24 : 10.0.0.2 }
|
|
|
bacbc8 |
+ </programlisting>
|
|
|
bacbc8 |
+ </example>
|
|
|
bacbc8 |
+ </refsect2>
|
|
|
bacbc8 |
+ <refsect2>
|
|
|
bacbc8 |
+ <title>Vmap statement</title>
|
|
|
bacbc8 |
+ <para>
|
|
|
bacbc8 |
+ The verdict map (vmap) statement works analogous to the map statement, but contains verdicts as values.
|
|
|
bacbc8 |
+ </para>
|
|
|
bacbc8 |
+ <para>
|
|
|
bacbc8 |
+ <cmdsynopsis>
|
|
|
bacbc8 |
+ <replaceable>expression</replaceable>
|
|
|
bacbc8 |
+ <command>vmap {</command>
|
|
|
bacbc8 |
+ <replaceable>key</replaceable>
|
|
|
bacbc8 |
+ <command>:</command>
|
|
|
bacbc8 |
+ <replaceable>value</replaceable>
|
|
|
bacbc8 |
+ <arg choice="opt" rep="repeat">
|
|
|
bacbc8 |
+ <command>,</command>
|
|
|
bacbc8 |
+ <replaceable>key</replaceable>
|
|
|
bacbc8 |
+ <command>:</command>
|
|
|
bacbc8 |
+ <replaceable>value</replaceable>
|
|
|
bacbc8 |
+ </arg>
|
|
|
bacbc8 |
+ <command>}</command>
|
|
|
bacbc8 |
+ </cmdsynopsis>
|
|
|
bacbc8 |
+ </para>
|
|
|
bacbc8 |
+ <example>
|
|
|
bacbc8 |
+ <title>using the vmap statement</title>
|
|
|
bacbc8 |
+ <programlisting>
|
|
|
bacbc8 |
+# jump to different chains depending on layer 4 protocol type:
|
|
|
bacbc8 |
+nft add rule ip filter input ip protocol vmap { tcp : jump tcp-chain, udp : jump udp-chain , icmp : jump icmp-chain }
|
|
|
bacbc8 |
+ </programlisting>
|
|
|
bacbc8 |
+ </example>
|
|
|
bacbc8 |
+ </refsect2>
|
|
|
bacbc8 |
</refsect1>
|
|
|
bacbc8 |
|
|
|
bacbc8 |
<refsect1>
|
|
|
bacbc8 |
--
|
|
|
bacbc8 |
2.21.0
|
|
|
bacbc8 |
|